Kaspersky Security Network

Kaspersky Security Network

The Kaspersky Security Network (KSN) is a complex distributed infrastructure dedicated tointelligently processing cybersecurity-related data streams from millions of voluntary
participants around the world. By analyzing these data streams automatically in the cloud,the system ensures the fastest reaction times to new and yet unknown cyberthreats and themaintenance of the highest levels of protection for every partner or customer.
KSN also employs Kaspersky Lab’s HuMachine principle: where our expert knowledge andnext-generation machine learning capabilities are merged, allowing us to spot patterns,changes and new threats in the cyber landscape with accuracy and skill.

Protection from unknown and advanced
cyberthreats
Today, the internet is an integral part of people’s lives, but it is also a source of growing risks.
In 2017 alone, Kaspersky Lab products detected 1.2 billion malicious attacks from online
resources and 246 million attempts to open a phishing site on user devices, nearly a 60%
increase compared to 2016. However, cybercrime has grown not only in volume, but also insophistication. Kaspersky Lab stats show that just 70% of the threats faced by users every day
are known, while 30% are unknown and advanced; demanding additional layers of protection.
The growing number and complexity of threats requires a specific approach to cybersecurity.
That is why traditional on-premise protection is not enough, and all leading security vendors
today use hybrid protection – a combination of device-based and cloud technologies.
This approach combines the advantages of traditional defensive methods, minimizing theirshortcomings, with the potential for global monitoring and continuously updated information
about new threats. The four main benefits of using cloud protection are:••••

Better detection rates
Reduced reaction time to new threats
Minimization of false positives
A ‘lighter’ product for the user

The basic principles of the Kaspersky
Security NetworkAll data processed is divided into the three key purposes for which it is used, in shortthese encompass: (a) supporting key product functionality, (b) increasing theeffectiveness and performance of the protection components, and (c) offering
improved and more suitable solutions to customers and providing them with theappropriate content;
The information processed is received from customers who have accepted an EndUser License Agreement (EULA), Privacy Policy, KSN agreement and other1
Kaspersky LabJune 2018

Kaspersky Security Network

agreements where the kind of information obtained and its purpose are described infull (the list of agreements and data shared depend on the product and service used);
The data received by KSN is not attributed to a specific individual. The information isused in the form of aggregated statistics and is stored on separate servers with strictpolicies regarding access rights;
The information shared is protected, even during transit, in accordance with legal
requirements and stringent industry standards, including through encryption, digital
certificates, firewalls and more.

Kaspersky Security Network workflow
Kaspersky Security Network’s working mechanism includes several key processes such as
the continuous, geographically-distributed monitoring of real-life threats on users’ devices,
analysis of the data received in order to determine new threats, and the delivery of relevant
intelligence and countermeasures to protect customers. The information about infectionattempts is analyzed using the company’s powerful in-house expertise and technologicalresources – both automated and human.
The safety of a program is determined through multi-layered checks with the help of machinelearning. This includes checking the behavior's reputation in the cloud – if it’s known as
dangerous - checking the source and integrity of the program, and many other factors.
A website’s safety is determined through checking the company’s digital certificate andverifying this certificate’s legitimacy, the analysis of webpage content for potential threats andtraps, its URL for reputation in the cloud, and many other factors.
Once a program or website is recognized as legitimate, it is added to the list of trustworthy
applications or websites (the whitelisting database). As soon as a program or website isdefined as malicious, it is reported to Kaspersky Lab’s Urgent Detection System and theinformation is made available to all users through the Kaspersky Security Network.
If it is not possible to determine the level of threat posed by an object, the data is sent toKaspersky Lab experts, who conduct additional in-depth analysis before adding the data to
KSN for instant detection through the cloud. This step is crucial as it allows KSN, like every
other Kaspersky Lab solution, to fuse next generation machine power with human expertise.
While creating and uploading the entry to a traditional antivirus database takes hours, KSN
users receive a corresponding measure of protection within minutes of the launch of acyberattack. KSN therefore assists both database and heuristic detection, in addition to
supporting whitelisting and application-control technologies via the continuous updating of
the list of legitimate programs.
Another feature of KSN that is worth a separate mention, is its cloud-assisted anti-spamtechnology. This uses information from the cloud to detect and block unsolicited messages
so that users do not require a local anti-spam filter.

2Kaspersky Lab
June 2018

Kaspersky Security Network

The flow-chart below illustrates the basic principles on which Kaspersky Lab’s products
interact with KSN. This interaction includes five different phases:
1. The product on the device detects suspicious activity which is not determined as
malicious by default on-premise and sends this information to Kaspersky Lab’s cloudinfrastructure.
2. If Kaspersky Lab users encounter an already-known cyberthreat (which is not yet in
the threat databases), the solution sends a request to KSN and receives animmediate verdict, thereby ensuring the highest level of protection.
3. If the Kaspersky Lab databases contain no corresponding records for a given
sequence of indicators, the data progresses to an automated analysis system that isable to recognize most new cyberthreats. This system draws on Kaspersky Lab’s
powerful human and machine resources instead of having to rely on those of user
devices – with Kaspersky Lab’s experts manually analyzing the information when big
data analysis cannot automatically render a verdict.
4. If the code or URL turns out to be malicious, the details are added to the Urgent
Detection System database and made available to all users within minutes of theinitial detection (and when the solution sends a request to KSN, it receives animmediate verdict on this threat).
5. If the code or URL turns out to be legitimate, the records are added to the whitelisting
database.

Kaspersky Security Network's front-end servers are located in different countries around theworld (Germany, Canada, China etc.), while the back-end servers are located in Russia,
where the largest part of Kaspersky Lab’s anti-malware research team works.

3Kaspersky Lab
June 2018

Kaspersky Security Network

Kaspersky Security Network for consumers
Apart from the general benefits of cloud-assisted protection, Kaspersky Lab’s consumer
products allow users to check the reputation of any file or program on the device based ondata from the Kaspersky Security Network. This reputation technology is called ‘Kaspersky
Application Advisor’:

Such queries return a verdict on the file in question (whether the program is legitimate or not)as well as the date when the file first appeared, its popularity by country and other data. Thisfeature allows users to do a basic check of unknown programs before launching them,although the same information is obtained automatically when a user tries to execute a file.

Kaspersky Security Network for businesses
4Kaspersky Lab
June 2018

Kaspersky Security Network

There are a number of functions in the Kaspersky Security Network specifically for corporate
products. Firstly, the cloud-assisted protection technology is used for application whitelisting,using data from the Kaspersky Security Network. Known legitimate files are automaticallygrouped into categories, such as games, commercial software, etc. Using these categories, asystems administrator can quickly establish and apply certain rules for specific types ofsoftware, in line with their security policy. The data for the Application Whitelisting databaseis supplied by more than 600 leading software vendors and is used along with ‘crowdsourced’ information.
The Kaspersky Security Center management solution provides businesses with granularcontrols over how the Kaspersky Security Network protects corporate endpoints. The
administrator can select whether cloud-based protection is enabled or disabled in the specificmodules of Kaspersky Endpoint Security for Business. It is also possible to disable thesending of data to the Kaspersky Security Network. In order to reduce bandwidth usage, aninternal Kaspersky Security Network proxy may be installed inside the local network to cachedata from KSN. IT departments can always monitor traffic sent to KSN if needed:

5Kaspersky Lab
June 2018

Kaspersky Security Network

The benefits of Kaspersky Security Network
Today, Kaspersky Security Network technology is used on millions of computers around theworld, providing a detailed global picture of how new cyberthreats evolve and circulate,where they originate and how many infection attempts occur within given periods of time.
The globally-distributed cyberthreat monitoring carried out by the Kaspersky Security
Network makes it easy to respond quickly to new threats, no matter where the sources andtargets are located.
The Kaspersky Security Network helps to build an efficient, proactive defense. Its accuracy isensured by well-oiled interaction between robots and experts – Kaspersky Lab’s HuMachine
approach. With this powerful combination, KSN helps to identify and block new threats
before they become widespread and can cause any significant damage to the client’s ITnetwork.
This proactive defense system is essential to ensure the stable and uninterrupted operationof IT equipment and the business processes it supports - it is crucial for businesses andconsumers that wish to benefit from next generation cybersecurity.

6Kaspersky Lab
June 2018