SophosLabs
Threat Intelligence
The threat landscape continues to evolve as bad actors engage in targeted and sophisticatedtactics, techniques, and procedures, abusing common security tools and legitimate programs.
SophosLabs tracks emerging security trends and evolving adversary tactics, which playa significant role in propagating advanced cyber threats: from the latest developments inransomware, the steady increase in malicious URLs and phishing attacks, to growing threat
evasion and persistence using exploits.
Security organizations must often increase the volume of threat intelligence they purchase as amethod to complement their existing data sets and security infrastructure. But instead, they areincreasing the number of false positives through the acquisition of un-curated data. SophosLabs’
threat research team and highly automated infrastructure utilizing next-generation tools,
has developed high-accuracy, distinctive and often exclusive data sets that are now available
commercially and can help improve detection and response capabilities.

The Global Strength of a Tier-1 Lab

Breadth of Data

With over three decades of advanced malware analysis, SophosLabs threat research lab
delivers industry-leading threat intelligence with performance, scalability and flexibility tomeet partners’ security workflows so they can focus on what they do best.

Ì Disparate and complementary
data sources with global
visibility

300,000-plus daily
suspicious URLs analyzed

500,000-plus daily
previously unseen
files analyzed

Ì Sophos product telemetry
derived from network andendpointÌ Mid-market centric data

Data Science
2,000-plus daily

Ì Security machine learning

come from legitimate websites

previously unseen Androidapps analyzed

Ì Deep learning using feedforward, convolutional,recurrent, and policy gradients

50 million

600 million daily

files for Neural Network genetic
similarity comparisonsLive Protection lookup
events added to data lake

80% of malicious URLs

Ì Transfer learning and domain
adaptation

Data Quality
Ì Data curation process to
reduce false positives

30,000-plus daily

300 million

malware samples added
to Live Protection cloud

files used for Machine
Learning model training

SophosLabs worldwide threat research infrastructure tracks malware trends and cyberthreats across geographies.

Ì Continuous PE file and URL
reputation assessment

SophosLabs Threat Intelligence

SophosLabs Analysis Platform
Our analysis framework uses layers of analytics to reduce unknowns with the goalof deriving verdicts and intelligence reports in seconds for most commonly used filetypes. To achieve this, we use a combination of signature-based detections, granularthreat analyzers and AI models in static and dynamic analysis modes. All our analysis
output is used in our Sophos products.
The SophosLabs Analysis Platform approach differentiates itself in the industry and offers
comprehensive file intelligence and URL analysis with an aggressive roadmap for support
of a variety of other types of threat object submissions.
Threat Intelligence is consumed through APIs that securely connect to our cloud
platform, or through data feeds.

SophosLabs Data Science Difference
Prevalent anti-malware detection technologies are effective at identifying malware withspecific characteristics. In-line products do not have the resources to expediently identify
and analyze files outside the blue lines in Figure 1, invariably letting through sophisticatedmalware. By adding deep learning techniques, such as feed-forward, convolutional,recurrent, and policy gradients we can identify files with suspicious attributes like thosefound in malware depicted inside the orange lines in Figure 2.
In this way, we expand the efficacy of the anti-malware solution to convict manypolymorphic malware variants that would otherwise have gone undetected.
Figure 1: Prevalent anti-malware technologies

Figure 2: SophosLabs AI assisted detection
Detection efficacy

Detection efficacy

Clean fileMalware

Suspicious

Ì Harness the power of Sophos
Labs’ 30-plus years ofexperience in threat analysis
and malware reversing
Ì SophosLabs threat
intelligence services areactively used in Sophosproducts
Ì SophosLabs submission
logic helps you determine
suspicious files requiring
further analysis
Ì Receive verdicts quickly tohelp Web and Email Gateway
and cloud products makefaster block/pass decisions
Ì Get detailed intelligencereports for EDR, MDR and IR
use casesÌ Threat analysis processusing progressive analysis
techniques with a
combination of traditional
threat analyzers and neuralnetwork modelingSophosLabs Threat Intelligence

Data Sources and Curation
It all starts with aggregating telemetry from Sophos network, endpoint and mobileproducts with a variety of complementary data sources to gain global visibility. Our
automated curation deduplicates entries, categorizes threat objects, reduces false
positives and updates reputations. Conflicting threat data is escalated for review by ourthreat experts.

Data sources
Threa t Int ellig enc e So urc es
Sophos Telemetry(Network, Endpoint, Mobile)

1

File Submissions

2Feeds & APIs

Spam Traps

Global Reputation
Static Analyzers
Dynamic Analysis (Sandbox)
Neural Network Modeling
Deep Learning

Web Crawlers
Honeypots

3Sophos Products

SophosLabs
Submission Logic

Industry Intel Sharing

OEM PartnerSolutions

Subscriptions

1 Threat Feeds

Open Source

Figure 3: SophosLabs data sources
and threat intelligence services

URL Malware
URL Phishing
URL Spam
URL Categories

2 Lookup Service

3 Intelligence Service

File hash
URLIP
APK fingerprint

File Intelligence
Web Intelligence
Static Analyzers
Dynamic Analysis

Feeds
Malicious URLs
The malicious URL feed from SophosLabs offers a significant percentage of unique/complementary data to others in the industry. Instead of large volumes of raw data, ourgoal is to provide accurate threat intelligence with curated malicious URLs to improve
uniqueness and quality.
Prevalent Categories

DomainURI

Description

Malware Repositories

3 million+

60 million+

Known bad sites
designed to spreadmalwareMalware Commandand Control

670,000

160,000

Known bad sites

Infected Sites withMalicious Redirects

16,00027,000Previously clean
sites that arefound to containmalware redirects

Potentially Unwanted
Apps (PUAs)

19,000

2 million+

Links withsuspicious apps

Phishing Sites

560,000

2 million

Known and zero-dayphishing sites and links

Email Spam Websites

1 million+52,000

Known and zeroday spam sites

SophosLabs Threat Intelligence

Web Categorization – Productivity and Compliance

Use Cases

The URL database is populated by hundreds of millions of daily searches throughSophos’ customers and partners. It is comprised of 80-plus categories and supports anylanguage.

Web Filtering, Auditing,Policy, Compliance

For optimization, hundreds of URI paths belonging to the same website may be rolledup under one domain/subdomain entity, except for URI paths that are classified under adifferent category than their parent domain. This organization makes the database muchsmaller than classifying each unique URI path, more efficient, and very fast.

Common Productsand Services
Gateway and Cloud: NGFW,UTM, Email Security

BenefitsÌ Audit and enforce web usage
corporate policy requirements
Ì Filter potentially unwantedapps (PUA)Ì Optimize query speed with a local
database of productivity URLs

Use Cases

Cloud Lookup Services

Blocking, Threat Hunting

File Malware, Malicious URLs, Productivity URLs and Android (APK)
Fingerprints
This service complements real time anti-malware solutions with the latest threat data
which may have not yet been updated locally for real-time protection. By initiating alookup for unknown file hashes, URLs, and APKs, your solution will mitigate protection
gaps.
SophosLabs maintains a significant, global database of all known-bad threat objects
it has identified using a combination of threat analytics and machine learning. This
threat data is available here before it finds its way on the threat database resident on theproduct.
All lookups to the service are accessible using a single Protobuf API, which is publishedin our Cloud Lookup Service SDK. Sophos OEM technical experts assist partners with API
integration, testing, and ongoing support.
File Malware

Malicious URLs

ProductivityURLs

APK Fingerprints

Size (2018)

One billion-plus

60 million

28 million

19 million

Updates

2,500

800

1,500

100

Frequency

One minuteSix minutes

One day

10 minutes

Supported file types:.exe, .dll, .doc, .docx, .docm, .xls, .xlsx, or .xlsm, .ppt, .pptx, .pptm, .rtf

Common Security
Products and Services
Ì Gateway and Cloud: NGFW,UTM, Email Security, EDR
Ì SOCaaS, MDR

Benefits
Ì Access to the latest available
SophosLabs threat intelligenceÌ Immediate response times
Ì API consumes low ondevice resources
Ì No need to maintain alocal threat database

SophosLabs Threat Intelligence

Cloud File Intelligence

Use Cases

SophosLabs performs extensive analysis on over 500,000 unique files daily.

Blocking, Intelligence/Reporting

File types are verified using True File Type (TFT), a Sophos file scanning technology, todetermine what the file is regardless of its extension.

Common Security
Products and Services

All file submissions to the service are accessible using a single RESTful API, which is
published in our Cloud File Intelligence Service SDK. Sophos OEM technical experts assist
partners with API integration, testing, and ongoing support.

Static Analysis
SophosLabs provides granular static analyzers to drastically speed up verdict outcomes
and deliver rich intelligence reports. Through the combination of traditional threat analysis
techniques and heavy use of machine learning models, SophosLabs can deliver verdicts
in seconds for common file types.

Key Features
Machine Learning Models

Malware Detection andReputation

Ì Genetic Similarity

Ì PE File Reputation

Ì File properties and metadataÌ File Path Similarity

Ì Deep file scanning– yara, antivirus

Ì Author, Date, Locales,
Languages, File format
version, Size, pagecount, Presence of links,
Presence of active content(macros, forms, etc.), OLE
objects, signatures

Ì Malicious Attributes

Ì Industry detection
coverage

Advance File Information

Supported file types:.exe, .dll, .doc, .docx, .docm, .xls, .xlsx, or .xlsm, .ppt, .pptx, .pptm, .rtf
Supported file types:.exe, .dll, .doc, .docx, .docm, .rtf, .xls, .xlsx, .xlsm, .ppt, .pptx, .pptm, .pdf, .xml, .mso, .zip,.bzip, .gzip, .rar, .tar, .lha/.lzh, .xz

Ì Gateway and Cloud: NGFW,UTM, Email Security, EDR
Ì SOCaaS, MDR, IR/Investigations

Benefits
Ì Advanced detection of neverbefore-seen files, including Officedocs, PDF, PE, XML, Archives, etc.
Ì Derive verdicts and intelligencein seconds (when possible)
Ì SophosLabs smart logic helps
you identify suspicious files
to programmatically submit
for further analysis
Ì Scalable to secure any size network

SophosLabs Threat Intelligence

Dynamic Analysis (Cloud Sandbox)
SophosLabs Cloud Sandbox utilizes the latest analysis techniques to identify malicious
files for unmatched visibility into unknown files.

Key Features
Malware and Potentially Unwanted Apps(PUA) detections

Known Malware Families

Other Malicious Behaviors

Ì Sophos antivirus file andmemory detections

Ì Yara patterns deep memory scans

Ì Evasion – anti-sandbox andanti-virtual machine tactics

Ì Sophos Intercept X machinelearning, CryptoGuard, andWipeGuard technologies

Ì Behavior patterns – IOCs
attributed to malware

Ì CryptominingÌ Deception technology

Supported file types:.exe, .dll, .doc, .docx, .docm, .rtf, .xls, .xlsx, .xlsm, .ppt, .pptx, .pptm, .pdf, .xml, .mso, .zip,.bzip, .gzip, .rar, .tar, .lha/.lzh, .xz

SophosLabs Data Privacy and Retention
Ì Customer data submissions to SophosLabs are stored and processed inthree regional data processing units in Europe, North America, and Asia
Pacific, so that customers can keep their data within their region
Ì These regional units are built as sealed units to ensure wehave clear PII boundaries for customer data
Ì SophosLabs may check the hash of a customer-submitted file with external
threat intelligence sources, but we do not share the actual file with third parties
Ì SophosLabs retains all classified malicious files anddeletes cleans files in a timely manner

For more information about our security policy visit
https://www.sophos.com/en-us/legal/sophoslabs-information-security-policy.aspx

For more information

OEM ContactEmail: oem@sophos.com

United Kingdom and Worldwide Sales
Tel: +44 (0)8447 671131
Email: sales@sophos.com

Please visit Sophos.com/oem

North American Sales
Toll Free: 1-866-866-2802
Email: nasales@sophos.com© Copyright 2022. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UKSophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
22-06-27 DS-NA (PS)

Australia and New Zealand SalesTel: +61 2 9409 9100
Email: sales@sophos.com.au

Asia Sales
Tel: +65 62244168
Email: salesasia@sophos.com