Turning Zero-Day into D-Day for Cybersecurity Threats

“Zero-day” is a term used to describe the culprit behind many of the security breaches we hear about almost daily  in the news. But what exactly does it mean? Zero-day — the first or “zeroth” day — refers to the point in time a security hole in code is revealed to hackers or cybersecurity professionals (e.g., a developer, researcher, software programmer).

The term comes from the Warez scene (warez being slang for wares — an abbreviation for computer software) where computer underground circles distribute unauthorized releases of copyrighted work on the same day as (or even before) the original product is released.

While that is the basic definition, zero-day threat is commonly used to describe two cases:

• Zero-Day Vulnerability: This refers to a security flaw in software, an application or operating system that has yet to be revealed to the software maker or antivirus vendors, though the vulnerability may be known to attackers. Because zero-day vulnerabilities have yet to be discovered, the vulnerability is not yet protected by a known signature or patch, leaving companies vulnerable to attacks.
• Zero-Day Exploit: This refers to code that attackers use to trigger the zero-day vulnerability to execute their malicious action into the vulnerable software, application or operating system. Since this is done unbeknownst to the victim, it is a critical cybersecurity threat.

In this slideshow, Guy Caspi, CEO of Deep Instinct, takes a closer look at the explosion of zero-day threats and how deep learning can help organizations better protect their valuable cyber assets.

Deep Learning: Combating Zero-Day Threats

Click through for a closer look at the explosion of zero-day threats and how deep learning can help organizations better protect their valuable cyber assets, as identified by Guy Caspi, CEO of Deep Instinct.

The Growing Danger of Zero-Day Threats

Symantec’s latest Internet Security Threat Report reveals that 430 million new malware variants were discovered in 2015, and the number of zero-day vulnerabilities discovered more than doubled to a record-breaking 54 – a 125 percent increase from 2014. The growing sophistication of cyber-crime rings that have adopted corporate behavior in their structuring of criminal operations, with detailed job roles and management, has increased their efficiency in carrying out attacks and offering services against enterprises and consumers. According to this report, professional cyber criminal attack groups leverage zero-day vulnerabilities for their own advantage or sell them to lower-level criminals on the open market where they are quickly commoditized.

The Growing Danger of Zero-Day Threats

Even once a zero-day vulnerability has been discovered, protecting against its exploitation in real time is extremely difficult — leaving end users and companies exposed to attacks. Software patches and updated antivirus signatures are time consuming. Even newer sandbox solutions cannot block threats in real time. Solutions that apply classic machine learning technology (by using elaborate algorithms to classify a file’s behavior as malicious or legitimate according to manually selected features) might do a better job at detecting against zero-day exploits, but the detection rates are still far from optimal.

Deep Learning: Combating Zero-Day Threats

While zero-day threats continue to evolve in number and complexity, new cyber solutions are emerging to combat their increasing sophistication. The application of deep learning to cybersecurity offers thorough cyber protection through real-time detection and prevention against zero-day threats. Deep learning is a novel branch of artificial intelligence that is inspired by the brain’s ability to learn to identify an object, turning its identification into second nature.

Deep Learning: Combating Zero-Day Threats

In deep learning, raw data on millions of malicious and legitimate files are utilized for training the technology to learn to differentiate between the file types on its own. As opposed to machine learning, this learning process is entirely independent and does not involve any human intervention or manual feature engineering. The result of the training process is the instant ability to predict (identify) first-seen malware with high accuracy compared to existing solutions on the market, even those that apply machine learning. The ability to detect zero-day threats in real time enables nearly instant prevention capability, blocking threats before they can cause harm.

Creating Zero Tolerance for Zero-Day Threats

With zero-day threats becoming a major factor in breaches, it is imperative to protect against the vulnerabilities caused by the difficulty in detecting them, as well as by the time lag between detection and prevention.

Detecting and blocking zero-day attacks is no easy feat. Legacy, signature-based methods cannot handle zero-day threats in real time because they require time-consuming, manually tuned heuristics to be able to detect them. Newer methods that evaluate zero-day exploits in a protected sandbox environment also fail to block threats in real time. More advanced solutions using artificial intelligence machine learning come to fill the void of real-time detection and prevention, but the detection accuracy issues that arise affect the efficacy of the protection they offer.

Deep learning as a cybersecurity solution brings a new proactive and predictive approach that effectively combats these security gaps abused by attackers. By leveraging deep learning, new, undetected threats are instinctively identified and blocked in real time before they can be exploited and cause harmful breaches. It’s D-Day for zero-day attacks when a solution can defeat them by blocking them before they can be carried out.