Q1 2019

Advanced Threat Defense
Certification Testing Report

Kaspersky Lab
Kaspersky Anti Targeted Attack Platform (KATA)

Tested against this standard
ICSA Labs Advanced Threat Defense Criteria v.1.0

April 4, 2019

Prepared by ICSA Labs
1000 Bent Creek Blvd., Suite 200
Mechanicsburg, PA 17050
www.icsalabs.com

ICSA Labs Advanced Threat Defense – Report-at-a-Glance
Kaspersky Lab
Executive Summary
During 28 days of testing during the first quarter of 2019, ICSA Labs tested the detection capabilities ofKaspersky Anti Targeted Attack Platform (KATA) with a mix of over 1000 test runs. The mix was primarily
composed of new and little-known malicious threats – i.e., recently harvested threats not detected bytraditional security products.
Periodically, ICSA Labs launched innocuous applications and activities to additionally test the KATA
platform in terms of false positives. Throughout testing, ICSA Labs observed product logs to ensure not
only that the KATA platform indicated the existence of a malicious threat but also that logged threats weredistinguishable from other logged traffic and events.
The KATA platform passed, having met all criteria requirements. As seen in Figure 1 below, Kaspersky’s
solution did remarkably well during this test cycle - detecting 99.6% of previously unknown threats while
having 0 false positives. Figures 2 and 3 below further highlight the solution’s detection effectiveness andfalse positives (FPs).

www.kaspersky.com/enterprisesecurity/anti-targeted-attack-platform

Test Length

28 days

Malicious Samples

495

Innocuous Apps

554

Test Runs

1049% Detected

99.6%% False Positives

0.0%

Fig. 1 – High Detection Effectiveness & Few False Positives

ICSA Labs
Advanced Threat Defense

Certified
Test Period:
Certified Since:

Q1 2019
12 / 2016
Fig. 2 – Detected 465 of 465 New & Little-Known Malicious Samples

ATD-KASPERSKY-2019-0404-01
Copyright © 2019 ICSA Labs. All rights reserved.

Fig. 3 – One Alerts on Innocuous Applications

Page 1 of 8
Criteria v.1.0

ICSA Labs Advanced Threat Defense - Certification Testing Report
Kaspersky Lab

Introduction
This is Kaspersky Lab’s tenth consecutive ICSA Labs Advanced Threat Defense Certification testing report for
Kaspersky Anti Targeted Attack Platform (KATA).
Standard ICSA Labs Advanced Threat Defense (ATD) testing is aimed at vendor solutions designed to detect new
threats that other traditional security products miss. Thus, the focus is on how effectively vendor ATD solutions detect
these unknown and little-known threats while minimizing false positives.
The remainder of the report presents a more detailed look at how the Kaspersky Lab KATA advanced threat defense
solution performed during this cycle of standard ICSA Labs ATD Certification testing. To better understand how tointerpret the results, this report documents not just the testing results themselves but the threat vectors, sample
sources, and kinds of samples that ICSA Labs employed for this cycle of ATD testing against Kaspersky Lab’s KATA.

Test Cycle Information
This report reflects the results of one test cycle at ICSA Labs. Standard ATD and ATD-Email test cycles are
performed by ICSA Labs each calendar quarter and typically range from three to five weeks in duration. To be eligible
for certification, security vendor solutions must be tested for at least 3 weeks. Because testing is performed quarterly,
ICSA Labs tests ATD solutions four times during a calendar year.
During each test cycle ICSA Labs subjects advanced threat defense solutions to hundreds of test runs. The test set iscomprised of a mix of new threats, little-known threats and innocuous applications and activities – delivered andlaunched one after another continuously for the length of testing. Below in Figure 4 is information about the test cyclefrom which this findings report is based.
Start Date

Jan. 23, 2019

Days of Continuous Testing28

End DateFeb. 19, 2019

Test Runs

1049

Fig. 4 – This Test Cycle

ATD Solution Tested
During this testing cycle, ICSA Labs tested the Kaspersky Anti Targeted Attack Platform (KATA) from Kaspersky Lab.


Kaspersky Anti Targeted Attack Platform – 3.5.0-1269
Kaspersky Anti Targeted Attack Platform (KATA) uses multi-layered threat detection – including a granularassessment of activity that’s occurring on the customer’s corporate network and at endpoints – to help protect
businesses and organizations against sophisticated threats and targeted attacks. KATA includes network
sensors, web and email sensors, as well as optional endpoint sensors that together help to detect threats –not just at the entry points - but wherever they arise within the customer’s IT infrastructure. KATA also
includes Kaspersky’s Targeted Attack Analyzer that assesses data from network and endpoint sensors – andrapidly generates threat detection verdicts for the security team. By combining sandbox-based analysis andKaspersky's advanced machine learning technologies, Kaspersky Anti Targeted Attack Platform helps todeliver protection against a wider range of threats.

For more information about the Kaspersky Lab KATA, its component parts and related information please visit:https://www.kaspersky.com/enterprise-security/anti-targeted-attack-platform
http://newsroom.kaspersky.eu/fileadmin/user_upload/de/Downloads/PDFs/KATA_Feature_List.pdf
https://www.kaspersky.com/enterprise-security/wiki-section/products/kaspersky-anti-targeted-attack-platform

ATD-KASPERSKY-2019-0404-01
Copyright © 2019 ICSA Labs. All rights reserved.

Page 2 of 8
Criteria v.1.0

ICSA Labs Advanced Threat Defense - Certification Testing Report
Kaspersky Lab

Detection EffectivenessTo meet the criteria requirements and attain (or retain) certification through ICSA Labs testing, advanced threat
defense solutions must be at least 75% effective at detecting new malicious threats. As shown in Figure 5 theKaspersky Lab KATA platform detected 99.6% of the threats it encountered during testing, considerably better thanthe percentage required for certification.

Fig. 5 – Detection Effectiveness of Kaspersky’s KATA

A second plot depicting the detection effectiveness of KATA appears in Figure 6. For Kaspersky Labs’ solution thechart sheds light on whether or not the KATA did better or worse – the newer the malicious sample. As is evident both
below and in the previous figure, regardless of how new or how old the threat, the Kaspersky KATA platform detected
99.6% of new and little-known malicious threats. Kaspersky KATA platform provided this excellent detection
effectiveness and had no false positives during this test cycle, which is impressive.

Fig. 6 – Detection Effectiveness by Age of Threat (Threats < 24 Hours Old)

ATD-KASPERSKY-2019-0404-01
Copyright © 2019 ICSA Labs. All rights reserved.

Page 3 of 8
Criteria v.1.0

ICSA Labs Advanced Threat Defense - Certification Testing Report
Kaspersky Lab

A final effectiveness-related plot to consider for Kaspersky Labs’ advanced threat defense solution KATA during thistest cycle is Figure 7 below. Plotted below is each of the 28 days during the test cycle along with how effective the
KATA platform was on each of those days. For an impressive 26 of 28 days during the test cycle, the Kaspersky
KATA platform was 100% effective against the new and little-known threats used in testing.

Fig. 7 – Detected & Missed Threats by Day of Test Cycle

Threat Vectors
In testing, ICSA Labs delivers new and little-known malicious threats to security vendor solutions using many of the
top threat vectors that have led to enterprise cybersecurity incidents and breaches as reported in the latest Verizon
Data Breach Investigation Report (DBIR).
DBIR data indicates that malware has been a key factor in thousands of security events where an information asset
had its integrity, confidentiality, and/or availability compromised. Figure 9 on the following page depicts the threat
vectors involved in these malware-related security incidents throughout the over ten year history of Verizon’s DBIR.
Figure 8 below illustrates the most common malware-related threat vectors that lead to enterprise breaches during
2017 alone (2018 DBIR).

Fig. 8 – Top Threat Vectors Leading to Breaches in 2017 (per 2018 DBIR data)

ATD-KASPERSKY-2019-0404-01
Copyright © 2019 ICSA Labs. All rights reserved.

Page 4 of 8
Criteria v.1.0

ICSA Labs Advanced Threat Defense - Certification Testing Report
Kaspersky Lab

Fig. 9 – Malware-Related Threat Vectors Involved in Incidents (DBIR All-Time)

Standard ICSA Labs ATD testing includes the threat vector that is by far the most prevalent over time, “Direct Install”.
In addition, standard ATD testing includes the threat vectors labeled “Web drive-by”, “Web download”, and “Download
by malware”. In the separate but related, ICSA Labs ATD-Email testing, ICSA Labs delivers new and little-known
malware in URLs and attachments, corresponding to DBIR threat vectors “Email attachment” and “Email link”, theformer being the second most common threat vector leading to enterprise breaches according to the 2018 DBIR (refer
to Figure 8 above).

Source of Samples
A number of sample sources feed ICSA Labs’ standard ATD and ATD-Email testing.
One source is the spam ICSA Labs collects. The labs’ spam honeypots receive approximately 250,000-300,000
spam email messages/day. For ICSA Labs ATD testing, the team harvests attachments in that spam, making use of
the ones that are malicious.
Samples may also come from malicious URLs. Some of these come from the spam mentioned above. From feeds
like this ICSA Labs filters and checks the URLs to see if there is a malicious file on the other end of that URL -- either
as a direct file link or a series of steps (e.g. a drive-by attack with a multi-stage download process) leading to it. If so,
ICSA Labs collects the sample for potential use in testing.
ICSA Labs additionally uses other tools and techniques to create unique malicious files as an attacker or penetration
tester might do. In some cases, these are trojanized versions of clean executables. In other cases, they may beoriginal executables that are malicious.
Still another source of samples is the samples themselves. Any dropped files resulting from running anothermalicious sample are also evaluated and potentially used in testing.
Finally – and importantly to test for false positives – ICSA Labs also launches legitimate executables. Runninginnocuous applications helps ensure that vendor solutions aren’t just identifying everything as malicious.

ATD-KASPERSKY-2019-0404-01
Copyright © 2019 ICSA Labs. All rights reserved.

Page 5 of 8
Criteria v.1.0

ICSA Labs Advanced Threat Defense - Certification Testing Report
Kaspersky Lab

Regarding the Samples from this Test Cycle
Samples harvested for use in ATD testing are often unmodified and used as is. That is the case if ICSA Labs
determines that the sample is new enough and/or not being detected by traditional security products. In many cases
malicious samples require modification before they can avoid detection by traditional security products.
Of the 495 malicious samples, Figure 10 shows that there were more original samples used and fewer samples that
required some kind of modification before use in testing. Of the 479 original samples, 202 were dropped, or left
behind by other malware. Figure 13 reveals the source of the 277 malicious samples used in testing that were neither
modified nor dropped.

Fig. 10 –Malicious Samples – Original vs. Modified

Fig. 11 – Unmodified/Non-Dropped Sample Sources

Prior ATD Reports
With this report, Kaspersky Labs’ KATA advanced threat defense solution passed all the test cases to retain ICSALabs Advanced Threat Defense Certification. Successful completion of this test cycle marks Kaspersky Labs’ 10thconsecutive quarter having met the ICSA Labs ATD certification testing criteria.
This and all earlier KATA certification testing reports can be found on the ICSA Labs web site at:https://www.icsalabs.com/product/kata

ATD-KASPERSKY-2019-0404-01
Copyright © 2019 ICSA Labs. All rights reserved.

Page 6 of 8
Criteria v.1.0

ICSA Labs Advanced Threat Defense - Certification Testing Report
Kaspersky Lab

Significance of the Test & Results
Readers of certification testing reports often wonder what the testing and results really mean. They ask, “In what way
is this report significant?” The four statements below sum up what this ICSA Labs Advanced Threat Defense
Certification Testing report should indicate to the reader:
1. ICSA Labs tested the Kaspersky Labs’ KATA advanced threat
defense solution using the primary threat vectors leading to enterprise
breaches according to Verizon’s Data Breach Investigations Report(DBIR).
2. ICSA Labs tests with malicious threats including new and little-known
Ransomware that other security products typically miss.
3. Kaspersky Labs’ KATA demonstrated superb threat detection
effectiveness against nearly 500 new and little-known threats.
4. The Kaspersky KATA platform had no false positives during this test
cycle, which is excellent.

ATD-KASPERSKY-2019-0404-01
Copyright © 2019 ICSA Labs. All rights reserved.

Page 7 of 8
Criteria v.1.0

ICSA Labs Advanced Threat Defense - Certification Testing Report
Kaspersky Lab

Authority
This report is issued by the authority of the General Manager, ICSA Labs. Tests are done under normal operating
conditions.

ICSA Labs

Kaspersky Lab

The goal of ICSA Labs is to significantly increase userand enterprise trust in information security products andsolutions. For more than 25 years, ICSA Labs, an
independent division of Verizon, has been providing
credible, independent, 3rd party security product testing
and certification for many of the world’s top security
product developers and service providers. Enterprises
worldwide rely on ICSA Labs to set and apply objective
testing and certification criteria for measuring productcompliance and performance.

Kaspersky Lab is one of the world’s fastest-growing
cybersecurity companies and the largest that is privatelyowned. The company is ranked among the world’s top
four vendors of security solutions for endpoint users(IDC, 2014). Since 1997 Kaspersky Lab has been an
innovator in cybersecurity and provides effective digital
security solutions and threat intelligence for large
enterprises, SMBs and consumers. Kaspersky Lab is aninternational company, operating in almost 200 countries
and territories across the globe, providing protection forover 400 million users worldwide.
https://www.kaspersky.com/

ICSA Labs
1000 Bent Creek Blvd., Suite 200
Mechanicsburg, PA 17050

ATD-KASPERSKY-2019-0404-01
Copyright © 2019 ICSA Labs. All rights reserved.

Kaspersky Lab Americas Headquarters
500 Unicorn Park, 3rd Floor
Woburn, MA 01801

Page 8 of 8
Criteria v.1.0