Malware Analysis Researchers Announce New Startup

A group of academic researchers who recently built a botnet-hunting prototype today officially launched a new startup that offers a cloud-based analysis of today's advanced malware.

Lastline emerged from stealth mode with its first product offering after being founded last year by Northeastern University researcher Engin Kirda and University of California-Santa Barbara researchers Christopher Kruegel and Giovanni Vigna. The new Previct product is a sensor that performs real-time traffic analysis to root out malicious code as well as command-and-control (C&C) traffic.

Kirda, Kruegel, and Vigna were part of a team of international malware analysis experts who created Disclosure, a tool that expands the view of botnet activity to a wider scale and detects C&C traffic in real-time. The prototype can sniff out previously unknown botnets, as well, the researchers say, and uses NetFlow in addition to custom features that provide more intelligence for catching botnets.

"We have been working on the problem of sophisticated malware for a long time," says Jens Andreassen, CEO of Lastline.

Previct sits behind the firewall and inspects incoming and outgoing traffic; it is available either as an appliance or software solution. It's not an intrusion prevention system, however, its founders say.

"We see it as a new layer of defense. IPSes look for denial-of-service attacks or SQL injection against a Web server. We don't do that," says Kruegel, co-founder and chief scientist at Lastline.

Lastline is addressing APT and other targeted attacks, he says. "If a user gets an email and clicks on a link that leads to a drive-by site or to an executable, we can detect a drive-by attacking coming in against that user. Or if an exploit is successful and loads actual malware, we will see the malware on its way in," he says.

Kruegel says Lastline's technology leverages the researchers' skills and development in big data and program analysis. "We have machine-learning on large-scale data sets. We collect NetFlows, DNS resolutions, and [can determine] what happened in their traffic" using custom algorithms, he says.

The goal is to provide organizations with threat information in an automated way and before they get infected or breached.

AV is not enough to catch malware anymore, co-founder and CTO Vigna says. "You need to have behavioral analysis to detect viruses. And now behind that, the next step is it has to be correlated with the network activity of a person on the network ... This is a new class of tools that looks at how the network behaves and what artifacts have been put in the network. We're aggregating this [intelligence] at a high level so it's a global view of the [threat]," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.