Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Federated learning i ...

 Business

What is the easiest way to find a threat (either phishing or spam) in your e-mail? A variety of technical headers and other indirect markers of an unwanted message can point the way, but we shouldn’t forget the most obvious bit — the message text. One might think it’s the first thing to analyze; after   show more ...  

all, the text is what cybercriminals or unscrupulous advertisers use to manipulate recipients. The task isn’t quite that simple, though; whereas signature analysis could cope with the task in the past, it is now necessary to analyze the text using machine-learning algorithms. And if the machine learning model is to be trained to classify messages correctly, it needs to be fed messages in significant quantities — and that is not always practical, for privacy reasons. We found a solution. Why isn’t signature analysis effective anymore? Ten years ago, catching a huge proportion of unwanted e-mail based purely on message text was relatively easy because cybercriminals used the same templates — the text of spam (and phishing) messages hardly changed. Today, cybercriminals continually improve the efficiency of their mailings, and they use millions of hooks: new video games, TV series, or smartphone models; political news; even emergencies (take, for example, the abundance of phishing and spam related to COVID-19). The massive variety of topics complicates the detection process. Moreover, attackers can even vary the text within one mailing wave to elude e-mail filters. Of course, signature-based approaches are still in use, though their success basically relies on encountering text that someone has already classified as unwanted or harmful. They can’t work proactively because spammers can bypass them by making changes to mailing text. The only way to deal with this problem is through machine learning. What’s the problem with learning? In recent years, machine-learning methods have shown good results in solving many problems. By analyzing a large amount of data, models learn to make decisions and find nontrivial common features in an information stream.  We use neural networks trained on technical e-mail headers, together with DMARC, to detect e-mail threats. So, why can’t we just do the same thing with message text? As mentioned above, models need a huge amount of data. In this case, the data consists of e-mails, and not only malicious ones — we need legitimate messages as well. Without them, teaching the model to distinguish an attack from legitimate correspondence would be impossible. We have numerous e-mail traps that catch all sorts of unwanted e-mails (we use them to make signatures) but obtaining legitimate letters for learning is a more complicated task. Typically, data is collected on servers for centralized learning. But when we are talking about text, additional difficulties arise: E-mails can contain private data, so storing and processing them in their original form would be unacceptable. So, how can we obtain a large enough collection of legitimate e-mails? Federated learning We solve that problem by using the federated learning method, neatly eliminating the need to collect legitimate e-mails and instead training models in a decentralized way. Model training takes place directly on the client’s mail servers, and the central server receives only the trained weights of the machine-learning models, not message text. At the central server, algorithms combine the data with the resulting version of the model, and then we send it back to client’s solutions, where model again proceeds to analyze the stream of e-mails. That’s a slightly simplified picture: Before the newly trained model is set loose on real letters, it goes through several iterations of additional training. In other words, two models work simultaneously on the e-mail server: one in training mode, the other in active mode. After several trips to the central server, the retrained model replaces the active one. It’s impossible to recover the text of specific e-mails from the model weights; thus its privacy during processing is assured. Nevertheless, training on real e-mails significantly improves the detection model’s quality. At the moment, we are already using this approach to spam classification, in test mode, in Kaspersky Security for Microsoft Office 365, and it’s showing outstanding results. Soon, it will be applied more widely and used to identify other threats such as phishing, BEC, and more.

 Companies to Watch

Cybersecurity firm NortonLifeLock (formerly Symantec) has agreed today to acquire German antivirus maker Avira from Bahrain-based Investcorp Technology Partners in a $360 million all-cash deal.

 Trends, Reports, Analysis

After a year in which COVID-19 upended the way we live, work and socialize, we are likely to see an increased threat from ransomware and fileless malware in 2021, according to ESET.

 Malware and Vulnerabilities

Forescout Technologies disclosed 33 new vulnerabilities, including four remote code execution flaws, in four different open-source TCP/IP stacks used by major IoT, OT, and IT device vendors.

 Threat Intel & Info Sharing

A large-scale phishing campaign is targeting 200 million Microsoft 365 users around the world, particularly within the financial services, healthcare, insurance, manufacturing, utilities, and telecom sectors.

 Feed

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

 Feed

Red Hat Security Advisory 2020-5372-01 - The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol, including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base browser.

 Feed

Ubuntu Security Notice 4656-2 - USN-4656-1 fixed several vulnerabilities in X.Org. This update provides the corresponding update for Ubuntu 14.04 ESM. Jan-Niklas Sohn discovered that the X.Org X Server XKB extension incorrectly handled certain inputs. A local attacker could possibly use this issue to escalate privileges. Various other issues were also addressed.

 Feed

Red Hat Security Advisory 2020-5365-01 - AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. This release of Red Hat AMQ Broker 7.8.0 serves as a replacement for Red   show more ...  

Hat AMQ Broker 7.7.0, and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include cross site scripting and server-side request forgery vulnerabilities.

 Feed

A zero-click remote code execution (RCE) bug in Microsoft Teams desktop apps could have allowed an adversary to execute arbitrary code by merely sending a specially-crafted chat message and compromise a target's system. The issues were reported to the Windows maker by Oskars Vegeris, a security engineer from Evolution Gaming, on August 31, 2020, before they were addressed at the end of October.

 Feed

The US National Security Agency (NSA) on Monday issued an advisory warning that Russian threat actors are leveraging recently disclosed VMware vulnerability to install malware on corporate systems and access protected data. Specifics regarding the identities of the threat actor exploiting the VMware flaw or when these attacks started were not disclosed. The development comes two weeks after the

 Feed

Some widely sold D-Link VPN router models have been found vulnerable to three new high-risk security vulnerabilities, leaving millions of home and business networks open to cyberattacks—even if they are secured with a strong password. Discovered by researchers at Digital Defense, the three security shortcomings were responsibly disclosed to D-Link on August 11, which, if exploited, could allow

 Feed

There seems to be a new ransomware story every day - a new ransomware attack, a new ransomware technique, criminals not providing encryption keys after receiving ransom payments, private data being publicly released by ransomware attackers—it never ends. Just last month, the FBI, the Department of Health and Human Services (HHS), and the Cybersecurity and Infrastructure Security Agency (CISA)

2020-12
Aggregator history
Tuesday, December 08
TUE
WED
THU
FRI
SAT
SUN
MON
DecemberJanuaryFebruary