Malware Analysis Researchers Announce New Startup

Lastline comes out of stealth with big data-based offering for catching advanced attacks

A group of academic researchers who recently built a botnet-hunting prototype today officially launched a new startup that offers a cloud-based analysis of todays advanced malware.
Lastline
emerged from stealth mode with its first product offering after being founded last year by Northeastern University researcher Engin Kirda and University of California-Santa Barbara researchers Christopher Kruegel and Giovanni Vigna. The new Previct product is a sensor that performs real-time traffic analysis to root out malicious code as well as command-and-control (C&C) traffic.
Kirda, Kruegel, and Vigna were part of a team of international malware analysis experts who
created Disclosure
, a tool that expands the view of botnet activity to a wider scale and detects C&C traffic in real-time. The prototype can sniff out previously unknown botnets, as well, the researchers say, and uses NetFlow in addition to custom features that provide more intelligence for catching botnets.
We have been working on the problem of sophisticated malware for a long time, says Jens Andreassen, CEO of Lastline.
Previct sits behind the firewall and inspects incoming and outgoing traffic; it is available either as an appliance or software solution. Its not an intrusion prevention system, however, its founders say.
We see it as a new layer of defense. IPSes look for denial-of-service attacks or SQL injection against a Web server. We dont do that, says Kruegel, co-founder and chief scientist at Lastline.
Lastline is addressing APT and other targeted attacks, he says. If a user gets an email and clicks on a link that leads to a drive-by site or to an executable, we can detect a drive-by attacking coming in against that user. Or if an exploit is successful and loads actual malware, we will see the malware on its way in, he says.
Kruegel says Lastlines technology leverages the researchers skills and development in big data and program analysis. We have machine-learning on large-scale data sets. We collect NetFlows, DNS resolutions, and [can determine] what happened in their traffic using custom algorithms, he says.
The goal is to provide organizations with threat information in an automated way and before they get infected or breached.
AV is not enough to catch malware anymore, co-founder and CTO Vigna says. You need to have behavioral analysis to detect viruses. And now behind that, the next step is it has to be correlated with the network activity of a person on the network ... This is a new class of tools that looks at how the network behaves and what artifacts have been put in the network. Were aggregating this [intelligence] at a high level so its a global view of the [threat], he says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Malware Analysis Researchers Announce New Startup