How It Works: Malware Detection and Prevention: An Introduction to SophosLabsTM

1
How It Works Malware Detection and Prevention
An Introduction to SophosLabsTM

• TJ Iacobone Senior Sales EngineerMay 2, 2006

2
Agenda

• Who are SophosLabs?
• What do SophosLabs do?
• Inside SophosLabs

3
Who are SophosLabs?
4
Who are SophosLabs?

• A global group within Sophos engineering
• 49 people
• In 4 countries

5
Global labs
6
What do SophosLabs do?
7
What do SophosLabs do?

• Protect Sophos customers 24/7

8
What do SophosLabs do?
Updates
Viruses
Alerts
Spam
Information
9
Updates

• Anti-virus updates
• 4-6 per day
• Protect against
• Viruses
• Worms
• Trojans
• Spyware

10
Updates

• Anti-spam updates
• Every 30 minutes
• Protect against
• Spam
• Phishing
• Stock scams

11
Alerts

• Virus alerts
• Free
• Notification of new threats
• Zombie alerts
• Notify customers of spam zombies on their
  networks
• Phishing alerts
• Notify customers of phishing attacks against
  their customers

12
Information

• Virus descriptions
• Statistics
• Top 10 malware
• Top spamming countries
• Background information for marketing and
  journalists

13
Inside SophosLabs
14
Analysis process
Get sample
Analyse
Detection
TEST
Publish
15
Analysis process
Get sample

• Virus - Customers, honeypots, AV vendors
• Spam - Spam traps, customers
• Automatic and manual
• Virus identities, spam rules, Genotypes

Analyse
Detection
16
Automatic analysis - viruses
17
Automatic analysis - spam
18
Manual analysis
19
(No Transcript)
20
Research - Soney
21
Development

• New detection techniques
• Spam rules
• Spam Genotypes
• Virus Genotypes
• Research and analysis tools

22
?