Home » Author / Marco Balduzzi (Senior Threat Researcher)

Senior Threat Researcher

Uncovering Unknown Threats With Human-Readable Machine Learning

Posted on:April 12, 2018
Posted in:Malware
Posted by:
Marco Balduzzi (Senior Threat Researcher)

In this blog post, we will discuss how we developed a human-readable machine learning system that is able to determine whether a downloaded file is benign or malicious in nature.

The development of this actionable intelligent system stemmed from the question: How can we make our knowledge about global software download events actionable? More specifically, how can we use such information to do a better job at detecting the threats posed by the large amounts of new malicious software circulating on a daily basis?

In this last installment of this blog series, we will answer such questions and give a summary of what we did with the information we’ve obtained. Our research paper titled Exploring the Long Tail of (Malicious) Software Downloads provides a more comprehensive look into how we’ve gathered and analyzed our software downloads data.

A Closer Look at Unpopular Software Downloads and the Risks They Pose to Organizations

Posted on:March 27, 2018
Posted in:Malware
Posted by:
Marco Balduzzi (Senior Threat Researcher)

As a large cyber security vendor, Trend Micro deals with millions of threat data per day. Our Smart Protection Network (SPN), among other technologies, helps us conduct research and investigate new threats and cybercrimes to improve our ability to protect our customers.

In this blog post, the first of a three-part series, I would like to share some insights on trends that we have observed in the wild after analyzing 3 million software downloads, involving hundreds of thousands of internet-connected machines.

Specifically, we turn our focus on web downloads originating from browsers or any other (HTTP) client application installed on a machine. Note that we limited the study to machines that execute software after download. Given the huge quantity of data, we also limited our research to unpopular software downloaded from URLs that were not whitelisted. This automatically excludes software from Windows Updates and other well-known domains. All this information is PII anonymized.

We classify these downloads as benign (legitimate software), malicious or unknown. Unknown means that the downloaded software is currently unknown to us or to other public data sources that we monitor.

Tags: benign software Malware software downloads unknown files

Detecting New Threats via Contextual Information and Reputation

Posted on:February 7, 2018
Posted in:Malware
Posted by:
Marco Balduzzi (Senior Threat Researcher)

Cybercriminals are constantly looking for new strategies to defeat security solutions and improve the success of their attacks.

The increase in adoption of polymorphism and packing has made traditional signature-based detection at the client side (endpoint) obsolete. Backend systems struggle in analyzing modern malware since both static and dynamic analysis are limited when heavily obfuscated code or anti-sandboxing techniques are employed. In addition, the number of newly discovered threats is increasing, and faster detection systems are required to protect users around the world.

Tags: machine learning

Red on Red: The Attack Landscape of the Dark Web

Posted on:May 30, 2017
Posted in:Deep Web
Posted by:
Marco Balduzzi (Senior Threat Researcher)

We’ve frequently talked about how limited-access networks such as the Dark Web is home to various cybercriminal underground hotspots. Hosted and accessed via the Tor network, these sites house underground marketplaces that sell various good and services, which include cryptocurrency laundering, hosting platforms for malware, and stolen/counterfeit identities.

What is less covered is the attack landscape within the Dark Web. Are these sites subject to their own hacking attempts and DDoS attacks? What are the sizes and characteristics of attacks within the Dark Web? This is what we have learned: these attacks are surprisingly common within the Dark Web, and are frequently carried out manually and aimed at subverting or spying on the services run by other cybercriminals.

Posted on:March 31, 2017
Posted in:Mobile
Posted by:
Marco Balduzzi (Senior Threat Researcher)

Over the last year, the number of mobile phones overtook the world population. In countries like the United States, mobile subscribers outnumbered traditional landline users and half of Americans shifted to mobile-only to communicate. In modern smart cities, wireless-only buildings are becoming the new construction standard for homes, factories, and organizations in general. Landline phones are going away—sooner rather than later.

Page 1 of 212

Uncovering Unknown Threats With Human-Readable Machine Learning

A Closer Look at Unpopular Software Downloads and the Risks They Pose to Organizations

Detecting New Threats via Contextual Information and Reputation

Red on Red: The Attack Landscape of the Dark Web

How Mobile Phones Turn Into A Corporate Threat

Security Predictions for 2018

Business Process Compromise

Stay Updated

Uncovering Unknown Threats With Human-Readable Machine Learning

A Closer Look at Unpopular Software Downloads and the Risks They Pose to Organizations

Detecting New Threats via Contextual Information and Reputation

Red on Red: The Attack Landscape of the Dark Web

How Mobile Phones Turn Into A Corporate Threat

Security Predictions for 2018

Business Process Compromise

Popular Posts

Stay Updated