06:13 PM
Connect Directly

Malware Analysis Researchers Announce New Startup

Lastline comes out of stealth with big data-based offering for catching advanced attacks

A group of academic researchers who recently built a botnet-hunting prototype today officially launched a new startup that offers a cloud-based analysis of today's advanced malware.

Lastline emerged from stealth mode with its first product offering after being founded last year by Northeastern University researcher Engin Kirda and University of California-Santa Barbara researchers Christopher Kruegel and Giovanni Vigna. The new Previct product is a sensor that performs real-time traffic analysis to root out malicious code as well as command-and-control (C&C) traffic.

Kirda, Kruegel, and Vigna were part of a team of international malware analysis experts who created Disclosure, a tool that expands the view of botnet activity to a wider scale and detects C&C traffic in real-time. The prototype can sniff out previously unknown botnets, as well, the researchers say, and uses NetFlow in addition to custom features that provide more intelligence for catching botnets.

"We have been working on the problem of sophisticated malware for a long time," says Jens Andreassen, CEO of Lastline.

Previct sits behind the firewall and inspects incoming and outgoing traffic; it is available either as an appliance or software solution. It's not an intrusion prevention system, however, its founders say.

"We see it as a new layer of defense. IPSes look for denial-of-service attacks or SQL injection against a Web server. We don't do that," says Kruegel, co-founder and chief scientist at Lastline.

Lastline is addressing APT and other targeted attacks, he says. "If a user gets an email and clicks on a link that leads to a drive-by site or to an executable, we can detect a drive-by attacking coming in against that user. Or if an exploit is successful and loads actual malware, we will see the malware on its way in," he says.

Kruegel says Lastline's technology leverages the researchers' skills and development in big data and program analysis. "We have machine-learning on large-scale data sets. We collect NetFlows, DNS resolutions, and [can determine] what happened in their traffic" using custom algorithms, he says.

The goal is to provide organizations with threat information in an automated way and before they get infected or breached.

AV is not enough to catch malware anymore, co-founder and CTO Vigna says. "You need to have behavioral analysis to detect viruses. And now behind that, the next step is it has to be correlated with the network activity of a person on the network ... This is a new class of tools that looks at how the network behaves and what artifacts have been put in the network. We're aggregating this [intelligence] at a high level so it's a global view of the [threat]," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.