Kaspersky Lab Research Articles

Qualified Vector Match and Merge Algorithm (QVMMA) for DDoS Prevention and Mitigation

Distributed Denial of Service (DDoS) attacks continue to instigate intense wars against popular ecommerce and content websites. One in five companies worldwide become a DDoS attack victim. Such attacks remain active causing prolonged damage from a few hours to several weeks. Deccan Chronicle34,35, dated April 29, 2015, reported above statement as conclusion of Kaspersky Lab's and B2B's international survey with categorizing two types of DDoS attacks: “a powerful short term attack or persistent long running campaign”. Both the above types of popular DDoS attacks can be detected, prevented and mitigated using the proposed novel Qualified Vector Match and Merge Algorithm (QVMMA) in real time. 14 feature components are used to generate an attack signature in real time and stored in dynamically updated DDoS Captured Attack Pattern (DCAP)30database. It's effective in detecting new and old attacks. Persistent DDoS attacks cause financial damage or reputation loss by loss of the company's valuable clients. The server's availability is heavily compromised. Popular websites Github and BBC UK faced DDoS attacks in 2015. Long term DDoS attack directed on Github continued for over 118 hours34,35. Short term DDoS attack experienced by BBC36 website caused its patchy response. The main crux of the problem is the absence of a way to differentiate between attack records and legitimate records while the attack is occurring in real time. Several methods1-31,37-42 are listed in the paper. Post mortem solutions are not applicable in real time. Available real time solutions are slow. QVMMA is an ideal faster real time solution to prevent DDoS attacks using Statistical Feature Vector Generation. Matlab is used for DDoS real time simulation where the topologies (bus, star, abilene network) are created using OMNET++33. QVMMA generates and uses Statistical Feature Vector for Attack Signature Generation, Matching and Identification only for qualifier satisfied records. The web server's log files used as input to QVMMA are according to W3C log format standard34. Experimentation is completed with exhaustive 336 cases. Four networks are tested with 5, 8, 10, 13 nodes. Performance evaluation of QVMMA concludes EER is 11.8% when threshold is 1.6. Abilene network achieves best result. As the number of attackers, nodes and intermediate routers increase, detection time increases. If threshold is increased, the accuracy reduces. If the number of nodes increases, accuracy increases. Thus it is concluded that QVMMA can be used for effective layer 3 DDoS Prevention and Mitigation in real time based on results generated in Matlab simulation.

윈도우즈 라이브러리로 위장한 Proxy DLL 악성코드 탐지기법에 대한 연구 : Winnti 사례를 중심으로

The Proxy DLL is a mechanism using a normal characteristics of Windows. Specific malware is executed via this mechanism after intrusion into a system which is targeted. If a intrusion of malware is successful, malware should be executed at least once. For execution, malware is disguised as a Windows Library. The malware of Winnti group is a good case for this. Winnti is a group of Chinese hacking groups identified by research in the fall of 2011 at Kaspersky Lab. Winnti group activities was negatively over the years to target the online video game industry, in this process by making a number of malware infected the online gaming company. In this paper, we perform research on detection techniques of Proxy DLL malware which is disguised as a Windows library through Winnti group case. The experiments that are undertaken to target real malware of Winnti show reliability of detection techniques.

News Briefing: Kaspersky lab connects humans to 'internet of us'

Researchers have been chipping every willing participant in sight to help identify the best direction in which to develop emerging implant technology.

The challenge of measuring cyber-dependent crimes

Cybercrime is now well-established and there are plenty of opportunities for cyber-criminals to make money – by stealing money from victims’ bank accounts and by selling stolen data on the underground market. As such, it is hardly surprising that government agencies, security vendors and businesses have sought to quantify the scale and cost of attacks. Some try to quantify the global impact, some focus on the impact within a specific geo-political region, and others try to estimate the cost of a specific attack. 1 , 2 , 3 Although it is a widely recognised problem, attempts to quantify cyber-dependent crime have resulted in dramatically varied numbers, highlighting the difficulty of trying to establish the scale, cost and impact of attacks. Prof Steven Furnell and Dr Maria Papadaki of Plymouth University, and David Emm of Kaspersky Lab examine various published sources in order to determine the nature (and potential quality) of the information, and underlying measures, relating to cyber-dependent crime. They find that it is more important to understand the impact of incidents (and how to prevent them) than to focus on metrics.

Global Cyberspace Is Safer than You Think: Real Trends in Cybercrime

What are the real trends in cybercrime? Recent media coverage has been rife with stories of large-scale data breaches, hacks and online financial crime. Information technology (IT) security firms such as Norton Symantec and Kaspersky Labs publish yearly reports that generally show the security of cyberspace to be poor and often getting worse. This paper argues that the level of security in cyberspace is actually far better than the picture described by media accounts and IT security reports. Currently, numbers on the occurrence of cybercrime are almost always depicted in either absolute (1,000 attacks per year) or as year-over-year percentage change terms (50 percent more attacks in 2014 than in 2013). To get an accurate picture of the security of cyberspace, cybercrime statistics need to be expressed as a proportion of the growing size of the Internet (similar to the routine practice of expressing crime as a proportion of a population, i.e., 15 murders per 1,000 people per year). To substantiate this argument, data was collected on the size of the Internet, with a focus on users, points of interaction and volume of online activity. Data was then collected on the vectors of cyber attack, the occurrence of cyber attacks and the cost of cybercrime. Normalizing these crime statistics around various measures of the growing size of cyberspace, a clear picture emerges: the absolute numbers always paint a worse scenario of the security of cyberspace than the normalized numbers. In particular, the absolute numbers tend to lead to one of three misrepresentations: first, the absolute numbers say things are getting worse, while the normalized numbers show that the situation is improving; second, both numbers show that things are improving, but the normalized numbers show that things are getting better at a faster rate; and third, both numbers say that things are getting worse, but the normalized numbers indicate that the situation is deteriorating more slowly than the absolute numbers. Overall, global cyberspace is actually far safer than commonly thought.

Insider threat becoming more significant, says Kaspersky

More than a quarter of businesses worldwide have lost sensitive business data due to internal IT threats in the past year, according to research by Kaspersky Lab.

The challenge and imperative of private sector cybersecurity: An international comparison

Attacks on computers and information networks, both public and private, are disclosed in the news daily. Most recently, Apple, Facebook, and Twitter acknowledged that they were attacked and were now taking additional measures to secure their networks. In January of 2013, Kaspersky Labs reported discovering malware that not only targeted government information in Eastern Europe, former Soviet republics, and Central Asia, but also had been actively doing so since 2007. The scope of global cyber attacks is staggering and the solutions to securing property and protecting national security are illusive, in large part because infrastructure is owned and operated by private, rather than public, entities. Nations struggle with choosing the most effective strategy and potential regulation of the private sector in order to reduce overall cybersecurity risk. This paper reviews the nature of cyber threats, and compares the United States and European approach to promoting cybersecurity in the private sector. Furthermore, the paper discusses how different approaches can affect cybersecurity risk, and suggests a framework for visualizing the impact of law and strategy on security.

Security for SMBs: why it's not just big businesses that should be concerned

The Internet has completely changed the way we work, live and communicate. Long gone are the days when the workforce was confined to a desktop PC and a day of 9-5. Today, the explosion of online and mobile technologies has resulted in a 24/7 worldwide workplace, with many employees working flexible hours, from remote locations and often from multiple devices. The development and deployment of new technologies has been accompanied every step of the way by the release of increasingly complex malicious software. Small and Medium-size Businesses (SMBs) might think themselves immune because they assume that attackers won't be interested in them. David Emm of Kaspersky Lab explains why this is wrong, how SMBs actually represent juicy targets for attackers, and proposes a security strategy for SMBs.

The real story of stuxnet

The paper discusses how Kaspersky Lab tracked down the malware that stymied Iran's nuclear-fuel enrichment program.

Kaspersky Lab: from Russia with anti-virus

Subject area International Business, International Entrepreneurship, International Marketing. Study level/applicability Advanced undergraduate and graduate students are the primary audience. The case can also be used in executive classes with emerging economies as a focus. Case overview Kaspersky Lab is a provider of information technology (IT) security products such as anti-virus, anti-spam and network security software. It is Russia's largest software company and the only Russian firm that ranked among the world's top 100 software companies. This case presents several interesting features of the company and its environment. The foci of the case are on potential barriers facing firms based in emerging economies in their internationalization initiatives and negative country of origin effects associated with emerging economies. Expected learning outcomes The learning objectives of this case include: To identify internal and external sources of competitive advantage for a developing world originated successful entrepreneurial firm. To assess the potential barriers facing an emerging economy-based firm in the internationalization process and analyse whether such barriers differ across economies of various characteristics. To evaluate whether the natures of obstacles and challenges faced by an emerging economy-based firm is different in a newly evolving industry. To analyze how an emerging economy-based firm can overcome some of the barriers to internationalization.

Placing a low-interaction honeypot in-the-wild: A review of mwcollectd

With more than 30 000 new malware threats being detected each day the threat of digital pollution continues to grow at pace. In this rapidly evolving climate, the ability to collect samples of malware which are spreading in-the-wild is a must for many different types of organisations, all of which have different aims. For example, at Kaspersky Lab we create signatures from these malware binaries and use them to maintain the protection of the 250 million users of our products around the world. Meanwhile, several non-profit organisations analyse such binaries to identify command and control servers of botnets and monitor them.

Russians steppe out

Kaspersky Labs is undoubtedly a thought leader in the anti-malware market, but its decision to specialize could prove risky in the long term.