Kaspersky Security Network:
Big Data-Powered Security
Cloud intelligencefor protection againstcomplex threats
The number of cyberattacks globally increases every day.
This has a significant impact on business, often resulting indata theft or loss of important information, threatening thebusiness processes of companies of every type and size,
from local start-ups to multinational industry leaders. And
it’s not just about the number of attacks – newgenerations of malware appear all the time, many using
new, sophisticated techniques to bypass existing security
solutions.
In this constantly shifting environment, protection is only aseffective as a vendor’s ability to closely monitor the threat
landscape and distill data into actionable intelligence for its
customers. To achieve this, security solutions must apply a
cloud approach that combines the widest possible scope of
threat data collection with the most intelligent dataprocessing technologies.
Kaspersky Security Network (KSN) is a complex distributed
infrastructure that integrates cloud-based technologies
into Kaspersky Lab’s products. KSN automatically analyzes
cybersecurity-related data streams from millions ofvoluntary participants around the world, providing thefastest detection of advanced and previously unknown
malware.

The key components of KSN success:• The acquisition of global malware detection statistics
along with real-time data on suspicious activities• A powerful combination of Big Data analysis, machinelearning and human expertise to process the collected
information• Fast delivery of threat intelligence to customers –leaving resource-intensive computation in the cloud.
The hardest part is sorting and analyzing the data – thevolumes are so huge that we use data science-based
automation, including several methods of artificial
intelligence, to process it. The human element remains animportant advantage of this system, because only humanintuition and experience can help machines to cope withthe complex and often highly imaginative creations ofmalware authors. Kaspersky Lab’s experts have real-timeaccess to all the information being gathered, enablingthem to gain valuable new insights into threats, apply
knowledge to investigations and develop new, proactive
detection technologies.
This approach offers numerous benefits for customers,
including:• Best detection of advanced and previously unknownmalware• Reduced detection errors (false positives)• Significant reduction in response times to newthreats – traditional signature-based responses cantake hours; KSN takes about 40 seconds.

KSN privacy protection
KSN processes data from a user’s device only after a user accepts the data processing agreement which describes the fullscope of data collected and the purposes of its processing. The information used in data processing is maximally anonymized,
data is stored and processed in accordance with strict security policies.

Similarity
HashDetection
SystemAstraeaReputationSystemKaspersky LabExperts
AndroidCloud ML

Big Data Processing CenterTreatment
Storage 500 Tb +KSN Clients

Fig.1 – Scheme of KSN elements

Astraea: Reputation system
based on Big Data
Hundreds of millions of different records come in to KSN, amassive volume of data often reaching hundreds ofgigabytes daily. This anonymized data is compressed andstored for future use; even after compression, it stillrequires terabytes of storage.
One of the systems Kaspersky Security Network uses toprocess this enormous data stream is called Astraea.
Every day, Astraea processes information on millions ofobjects, sorting and analyzing it. Once sorted, it rates eachobject (only the metadata of the object used for theanalysis, not its contents).
Every suspicious event received by the system is evaluatedaccording to importance and potential danger using multiple criteria. Following this analysis, the object’s reputation
is calculated, and global statistics about it are requested.
What else can the collective intelligence tell us about it?
Perhaps its reputation is even worse than it initially seems?
Or is it a false alarm? This querying against other information
allows the system to fine-tune verdicts and reduce theprobability of false positives.
When an object’s accumulated statistics confirm that it’smalicious, secure or has an unknown status, that
information is made available across all supported
Kaspersky Lab products where users have enabled
Kaspersky Security Network – without any humanintervention. Similarly, when malicious web resources areprocessed, users automatically receive a warning of thedanger when they try to access it.

Fig. 2 – Dangerous site alert

Astraea is a highly intelligent system that constantly learns todeal with the rapidly changing threat landscape. However,for all the advantages of automation, protection without
people is impossible, because the system has tounderstand to withstand the inventive detection evasion
techniques of human cybercriminals. That is why KSN (likeother Kaspersky Lab products and systems) uses theHuMachine principle – combining machine power andhuman expertise.

How does this work? If Astraea can’t determine the level of
threat posed by an object, the data is sent to humanexperts who conduct additional in-depth analysis before
adding the data to KSN for instant detection through thecloud. At the same time, heuristic detection models can be
adjusted to detect many different malware specimens
based on the similarity of indicators..

Machine learning in KSN
Together with the Astraea reputation system, two cloud
ML-based technologies are available through KSN toproactively detect unknown threats. In both cases, MLmodels are created and trained in-lab, while an endpoint or
mobile product just applies them for fast, real-timedetection.

Similarity Hash Detection
It used to be that hashes were used to create malware“footprints” sensitive to every small change in a file. Thisdrawback was exploited by malware writers throughobfuscation techniques like server-side polymorphism:
minor changes in malware took it off the radar. KL
products address this threat with several advanced
methods to detect malware variations. Similarity hashes(SH) is one of them.
The cloud component of the Similarity Hash Detection
system collects multiple file features from different
sources including in-lab automatic systems of malware
processing. Then a machine learning approach is used tofind the features common to the whole group of similar
malicious files. Based on these features, similarity hashes
are calculated and published through KSN.
The endpoint product extracts a file’s features at theendpoint, calculates its SH and checks it through both
local and cloud SH databases. Even if a new malware file issomewhat different from a known one, its SH will be similar
or identical to the SH already known to KSN. This approachallows Kaspersky Lab products to detect whole families ofquickly changing polymorphic malware.

application – its entry points, permissions, etc. – to get
the most accurate description of the app (no sensitive
user data is collected). This data vector is sent to the KSN
cloud where it’s run through the Android Cloud ML model,
and its classification decision is immediately sent back to
the mobile device.

Expertise for the real world
Threat intelligence delivery from KSN is fast – it’s measured inseconds. This maintains a consistently high level ofprotection against real-world, real-time cyberthreats. In
the event of a mass attack, when information about themalware has already reached KSN servers but has not yet
been delivered to end-users in the form of detection
records, the system will provide it immediately in response toa user request.
Of course, this requires some bandwidth, and Internet
traffic may be limited. KSN can use local caching servers
installed within the local network, which helps to reduce theload on the Internet connection. If a user has switched KSNoff, they only receive information about new malware
following an update – until then, they continue to beprotected by other proactive mechanisms.

Kaspersky Private Security
Network
While all information processed by Kaspersky Security
Network is completely anonymized and disassociatedfrom source, Kaspersky Lab recognizes that someorganizations – for compliance or company policy
reasons – require absolute data lockdown. This has
traditionally meant that enterprises can’t avail ofcloud-based security services.

Android Cloud ML

For these customers, Kaspersky Lab has developed astandalone product: Kaspersky Private Security Network,
which allows enterprises to take advantage of most of thebenefits of global cloud-based threat intelligence without
releasing any data whatsoever beyond their controlled
perimeter. It’s a company’s personal, local and completely
private version of Kaspersky Security Network.

In our ML-based system of mobile threats detection, thepredictive model takes the form of a Decision Tree
Ensemble. Every non-leaf node of a tree contains aquestion about the features of the file being examined,
while the leaf nodes contain decisions on the file; decisions ofmultiple trees are averaged in an algorithm-specific way toprovide the final classification of the file: malicious or not.

Kaspersky Private Security Network can be installed on aspecial local server, providing adaptive protection to all
connected devices. It does not allow access to theInternet – in an especially strict environment, updates canbe done manually using secure portable media. Either way,
the provision of an inbound data stream greatly boosts
reaction times to constantly shifting threats:

This type of powerful ML model trained on millions ofsamples can detect malware with high accuracy but it
requires lots of resources to run which would be hard toprovide on a simple mobile device. This is where we benefit
from the cloud approach. First, the agent on a user’s
device collects multiple features of an Android

Your Isolated Security Perimeter

Security forStorage

Anti-Targeted Attackplatform

Kaspersky Security
Network (KSN)

Kaspersky Private
Security Network
Reputation data
updates

Embedded Systems
Security

Endpoint Security

Hybrid Cloud
Security

Fraud
Prevention

Kaspersky Securityfor Mail Server

Kaspersky Security
for Internet Gateway• File reputations• URL reputations• Anomalous behaviour
patterns• Additional services

Reputation
request/response

Globalstatistics

Kaspersky Lab
customers

Fig.3 – Scheme of KPSN infrastructure in secured perimeterConclusion
The need for immediate protection against new threats isobvious, even to those who aren’t directly involved in
information security. Even without Kaspersky Security
Network enabled, the multiple layers of protection
technologies in our solutions provide effective security
for all users.

Complex and targeted threats tend to cause significantly
greater damage than mass malware. Kaspersky Security
Network and its private version protect your businessagainst these threats, mitigating attack risks and reducing
costs while ensuring data security and business continuity.

What KSN’s instant, cloud-based protection adds to themix is support for additional, important security
mechanisms that minimize false positives while increasing thequality of detection using real-time, additional data onthreats, authorized applications and other relevant
information.

Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com
IT Security for SMB: kaspersky.com/business
IT Security for Enterprise: kaspersky.com/enterprisewww.kaspersky.com
2020 AO Kaspersky Lab. All rights reserved.
Registered trademarks and service marks are the propertyof their respective owners.

We are proven. We are independent. We aretransparent. We are committed to building a safer
world, where technology improves our lives. Whichis why we secure it, so everyone everywhere has theendless opportunities it brings. Bring on cybersecurity
for a safer tomorrow.
Know more at kaspersky.com/transparency