Kaspersky Threat Attribution Engine
An unrivaled malware analysis tool providing insights into the origin of malware and its possible authors

Overview

Tracking, analyzing, interpreting and mitigating constantly evolving IT security threats is a massive undertaking. Setting aside all the hype, threat intelligence is of true value, and threat attribution is a critical element here.

There’s a good reason why threat attribution plays such a significant role in cybersecurity. The average time lag between detecting and responding to highly sophisticated threats can be frustratingly protracted, due to the complex investigation and reverse engineering processes involved. In many cases, this delay can give attackers enough time to reach their goals. Correct and timely attribution helps not only to shorten incident response times from hours to minutes, but also to reduce the number of false positives.

Identifying a targeted attack, profiling the attackers and creating attribution factors for the different threat actors is a long and complex job, which can take years. Creating a working attribution also requires a large amount of data accumulated over time, as well as a highly-skilled team of researchers with the relevant investigation experience. These researchers will commonly follow the activity of different groups, and populate a database with all the pieces of information accrued. This database then becomes a valuable resource that can be shared as a tool.

Kaspersky Threat Attribution Engine incorporates a database comprising APT malware samples and clean files gathered by Kaspersky experts over the last 25 years and more. We track 1100+ threat actors and campaigns and release 120+ threat intelligence reports a year. Our ongoing research supports an APT collection which contains some 83,000 files. This improves false flag detection and, in conjunction with the use of automated tools, results in outstandingly accurate levels of attribution.

The product offers a unique approach to comparing similar samples while ensuring near-zero false positive rates. Any new attack can quickly be linked to known APT malware, previous targeted attacks and hacker groups, helping you to distinguish high-risk threats from less serious incidents, so you can take timely protective measures to prevent an attacker from gaining a foothold in your system.

Kaspersky Threat Attribution Engine further extends and strengthens the Kaspersky portfolio for national cybersecurity agencies and commercial Security Operations Centers (SOCs) by supporting them in establishing an effective incident management process.

Kaspersky Threat Attribution Engine significantly improves security operations, helping to:

• Rapidly attribute files to known APT actors, revealing the motivations, methods and tools behind cyber incidents;
• Quickly evaluate whether you are the target of an attack or a side victim, so you can initiate the proper containment and response procedures;
• Ensure effective and timely APT threat mitigation based on actionable threat intelligence provided in Kaspersky APT Intelligence Reporting.

---

Prior knowledge as a strategic advantage

While conducting their operations, hackers normally follow a set of tactics, techniques and procedures. Cyber security experts are able to identify threat actors by studying these elements. Effective and efficient attribution always involves a highly-skilled team of researchers with experience in forensics and investigation, and is based on many years’ worth of accumulated data. This kind of database become a valuable resource that can be shared as a tool.

Use Cases

How It Works

To link malware to attribution entities, Kaspersky Threat Attribution Engine uses a unique proprietary method of searching for similarities between files. This method involves:

1. Analyzing the genetics of a sample by extracting the following elements from its code:
   a) Genotypes — distinctive pieces of binary code.
   b) Strings — distinctive strings of characters.
2. Automatically searching the analyzed files for genotypes and strings which are similar to genotypes and strings of APT samples previously analyzed, or already linked to attribution entities.
3. Based on similar genotypes and strings found in APT samples, providing a report on the origin of the analyzed sample, related attribution entities, and any similarities between this sample and known APT samples.

The product can be deployed in secure, air-gapped environments, restricting any 3rd party from accessing the processed information and submitted objects. An API connects the Engine to other tools and frameworks in order to implement attribution into existing infrastructure and automated processes.

Documentation

Download the Kaspersky Threat Attribution Engine Datasheet (PDF).