Presentation is loading. Please wait.

Presentation is loading. Please wait.

Copyright 2009 Trend Micro Inc. Talos: Building World-Wide Domain Reputation Ray Liao Jerry J Wu Trend.

Similar presentations


Presentation on theme: "Copyright 2009 Trend Micro Inc. Talos: Building World-Wide Domain Reputation Ray Liao Jerry J Wu Trend."— Presentation transcript:

1 Copyright 2009 Trend Micro Inc. Talos: Building World-Wide Domain Reputation Ray Liao Jerry J Wu Trend Micro Inc. 2014/10/10 Talos. External

2 Copyright 2009 Trend Micro Inc. Classification 10/10/2014 2

3 Copyright 2009 Trend Micro Inc. Types of Analysis 2014/10/10 Talos. External

4 Copyright 2009 Trend Micro Inc. Goal Comprehensive domain reputation –High risk domains –Legitimate domains –Not compromised sites Rate by intention 2014/10/10 Talos. External

5 Copyright 2009 Trend Micro Inc. How? Domain Snapshot Domain History Analysis –Identify classes of event worthy of investigation. –Identify domains associated with suspicious events. 2014/10/10 Talos. External 5

6 Copyright 2009 Trend Micro Inc. Sourcing How to get a whole picture, domain-wise? –No single type of sourcing is perfect (legal, anonymous services, etc…) –Combination of various types of data sources –Observational data. 2014/10/10 Talos. External

7 Copyright 2009 Trend Micro Inc. Building the network structure Organize domains by –Structural relationship –Custom defined. –Indexing for fast lookup. 2014/10/10 Talos. External

8 Copyright 2009 Trend Micro Inc. 2014/10/10 System Architecture Talos. External

9 Copyright 2009 Trend Micro Inc. Static Analysis Analysis based on a single snapshot of world- wide domains –Analysis by keyword –Analysis by structure (relationship) 2014/10/10 Talos. External

10 Copyright 2009 Trend Micro Inc. Keyword analysis Phishing attack –Masquerading as other trustworthy entity. –Similarity to the object of the masquerade Content Domain name Template generated disposable domains 2014/10/10 Talos. External

11 Copyright 2009 Trend Micro Inc. Static Analysis – Example (1) 2014/10/10 Talos. External

12 Copyright 2009 Trend Micro Inc. Analysis by relationship Form follows function Reuse of the existing network structure –Business reuse infrastructure –So does bad guys –Most attacks are not alone Observation –Good guy: likes repels likes –Bad guy: likes attract likes 2014/10/10 Talos. External

13 Copyright 2009 Trend Micro Inc. Static Analysis – Example (2) 2014/10/10 Talos. External

14 Copyright 2009 Trend Micro Inc. Static Analysis – Example (3) 2014/10/10 Talos. External

15 Copyright 2009 Trend Micro Inc. Static Analysis – Example (4) 2014/10/10 Talos. External

16 Copyright 2009 Trend Micro Inc. Dynamic Analysis Analysis across multiple snapshots –More complex than static analysis –Type of change (from X to Y) –What is being changed (value) –Rate of change –More 2014/10/10 Talos. External

17 Copyright 2009 Trend Micro Inc. Dynamic Analysis – Example (4) 2014/10/10 Talos. External LCS Domains Rating RegistrantDate [item] ideaitem.info. MaliciousGeorge --- 4/24 [item] itemgroup.info. MaliciousGeorge --- 4/24 [item] itemhosting.info. MaliciousGeorge --- 4/24 [item] itemmusic.info. MaliciousGeorge --- 4/24 [item] propertyitem.info. No RatingGeorge --- 4/24 [item] youitem.info. No RatingGeorge --- 4/24 [item] ideaitem.info. MaliciousGeorge --- 4/24 [item] imageitem.info. MaliciousGeorge --- 4/24 [item] itemgroup.info. MaliciousGeorge --- 4/24 [item] itemhosting.info. MaliciousGeorge --- 4/24 [item] itemsoft.info. MaliciousGeorge --- 4/24 [item] propertyitem.info. No RatingGeorge --- 4/24 [item] youitem.info. No Rating George --- 4/24 [yahoo] coolyahoo.info. MaliciousDorothy --- 4/24 [yahoo] dotyahoo.info. MaliciousDorothy --- 4/24 [yahoo] lifeyahoo.info.MaliciousDorothy --- 4/24 [yahoo] MaliciousDorothy --- 4/24 [yahoo] yahooblue.info. MaliciousDorothy --- 4/24

18 Copyright 2009 Trend Micro Inc. qebinehuh.com Classification 10/10/

19 Copyright 2009 Trend Micro Inc. Some Statistics about Talos 9 billions of domain related records as input per day 4TB of domain information in the past three months, in which 1 billion domains are involved and been frequently accessed 1 million domains identified as white-listed domains –Refreshed daily Classification 10/10/

20 Copyright 2009 Trend Micro Inc. Questions? Classification 10/10/

21 Copyright 2009 Trend Micro Inc. Thank You Classification 10/10/


Download ppt "Copyright 2009 Trend Micro Inc. Talos: Building World-Wide Domain Reputation Ray Liao Jerry J Wu Trend."

Similar presentations


Ads by Google