Intercept X Deep Learning
Intercept X combines deep learning with best-in-class anti-exploit technology,
CryptoGuard anti-ransomware, root cause analysis, and more to form theindustry’s most comprehensive endpoint protection. This unique combinationof features allows Intercept X to stop the widest range of endpoint threats.
Highlights
ÌÌ The number one
performing malware
detection engine
ÌÌ Prevents both known andnever-seen-before malware
ÌÌ Blocks malware before it
executesÌÌ Does not rely on signatures
ÌÌ Protects even when thehost is offlineÌÌ Detects malware inapproximately 20milliseconds
ÌÌ Trained on hundreds ofmillions of samples
ÌÌ Proven on VirusTotal sinceAugust of 2016
ÌÌ Classifies files as malicious,
potentially unwanted apps
(PUA), or benignÌÌ Works out of the box withno additional training
neededÌÌ Extremely small footprint(under 20MB)
ÌÌ Focused on Windows
portable executables

Much of today’s security is reactive and far too slow. As the volume and complexity of
endpoint attacks has continued to grow, legacy approaches have struggled to keeppace. For example, SophosLabs analyzes over 400,000 new malware samples everyday. To make meeting this challenge even more difficult, SophosLabs found that 75%
percent of malware is unique to a single organization.
Deep learning, an advanced form of machine learning, is helping to change the way
we approach endpoint security, and Intercept X is leading the charge. By integrating
deep learning, Intercept X is changing endpoint security from a reactive to a predictive
approach to protect against unknown threats.

Deep Learning vs. Other Types of Machine Learning“Intercept X uses a deep learning neural networkthat works like the human brain… This results ina high accuracy rate for both existing and zeroday malware, and a lower false positive rate.”
ESG Lab Report, December 2017

While many products claim to use machine learning, not all machine learning iscreated equally. At Sophos, we use deep learning to detect malware. Also referred toas ‘deep learning neural networks’ or ‘neural networks’, deep learning was inspired by
the way the human brain works. It is the same type of machine learning often used for
facial recognition, natural language processing, self-driving cars, and other advanced
fields of computer science and research.
Deep learning has consistently outperformed other machine learning models, including
random forest, k-means clustering, or Bayesian networks, but requires vast amountsof data and computational power to build an effective model. At Sophos, this has been
made simple thanks to the malware collection and analysis efforts of SophosLabs overthe past 30 years and the telemetry we receive from our 100+ million endpoints every
single day.

Intercept X Deep Learning
Deep learning has several inherent benefits comparedto other types of machine learning commonly used in
endpoint security:
Smarter: Deep learning models process data throughmultiple analysis layers, just like neurons in the humanbrain, each layer making the model considerably more
powerful. It analyzes complex relationships between
different input features. This allows it to automatically
uncover the best combination and manipulation ofinputs that would otherwise be impossible for humans
to determine. This means that the Sophos deep learning
malware detection model will be able to detect malware
that would go unnoticed by other machine learning engines.
More Scalable: Deep Learning elegantly scales tohundreds of millions of training samples. This is importantconsidering that SophosLabs analyzes 2.8 million new
malware samples every week. Because it can continue toingest massive amounts of training data our model can‘memorize’ the entire observable threat landscape as partof its training process. Since it can process significantly
more input, deep learning can more accurately predict
threats today while continuing to stay up-to-date over time.
Lighter: Traditional machine learning approaches resultin huge model sizes, which can sometimes take many
gigabytes on disk. However, Sophos’ deep learning
approach results in highly compressed models. The Sophos
deep learning model is incredibly small, less than 20MB on
the endpoint, with almost zero impact on performance.

Sophos Deep Learning Capabilities
Sophos provides deep learning expertise with industry’s
highest-performing malware detection engine:
Experienced: Unlike the competition, we have been
cybersecurity machine learning experts for a long time, andhave had our malware detection deep learning models inproduction environments for years. The Sophos malware
detection model was created by our team of data scientists
with DARPA driven technology. In 2010, the US Defense
Advanced Research Projects Agency (DARPA), created their
Cyber Genome Program to uncover the ‘DNA’ of malware
and other cyber threats. This was the origin of what is now
the algorithm embedded in Intercept X.

United Kingdom and Worldwide Sales
Tel: +44 (0)8447 671131
Email: sales@sophos.com

North American Sales
Toll Free: 1-866-866-2802
Email: nasales@sophos.com© Copyright 2018. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
18-03-20 DS NA (2897-MP)

Proven: We have been open and transparent with ourmodels. In addition to presenting details of our methodology
at industry conferences such as Black Hat, we also havenot shied away from allowing our model to be tested byindependent third parties. The model has been proven on
VirusTotal since August of 2016, and has received highscores from third-party testers such as NSS Labs. In allcases, it has proven to be extremely effective while having
low false positives.

“One of the best performance scores
we have ever seen in our tests”
Maik Morgenstern, CTO, AV-TEST

Performance: Sophos’ Deep Learning technology isincredibly fast. In less than 20 milliseconds the model isable to extract millions of features from a file, conduct a
deep analysis, and determine if a file is benign or malicious.
This entire process happens before the file executes.
SophosLabs: One of the most important aspects to any
model is the data that used for training. Our team of data
scientists are part of the SophosLabs group, granting themaccess to hundreds of millions of samples. This allows
them to create the best possible predictions in our models.
The integration between the two groups also leads tobetter data labeling (and therefore better modeling). The
bi-directional sharing of threat intelligence and real-world
feedback between the team of data scientists and threat
researchers continuously improves the accuracy of ourmodels.

“Intercept X stopped every complex,
advanced attack we threw at it”
ESG Lab Report, December 2017

Try it now for free
Register for a free 30-day evaluation
at sophos.com/interceptx
Australia and New Zealand Sales
Tel: +61 2 9409 9100
Email: sales@sophos.com.au

Asia Sales
Tel: +65 62244168
Email: salesasia@sophos.com