Cyber Defense Magazine - Annual RSA Conference 2019 - Print Edition

360 ESG, itself, is endowed
with PE sample collection
capacity at tens of billions
level. The capability of fulldose
data collection and rapid
data processing makes 360
more efficient in producing
threat intelligence. On the one
hand, the timeliness of threat
intelligence is guaranteed to
the greatest extent; on the
other hand, the customization
capability of threat intelligence
products in many subdivided
fields is also supported by
sufficient data.
Then how can 360 ESG own
such big data for security? To be
more specific, it aims to provide
useful and all-dimensional IP
reputation for information and
realize the ability to discover,
evaluate and track a variety of
epidemic and advanced targeted
attacks by producing attack
discovery logs of vast terminal
samples, active defense data,
file credit information and a
variety of security products (such
as website security, firewall,
situational awareness, advanced
threat discovery, etc.), and
integrating the identification
and portraits of associated threat
sources based on huge security
terminal software installation
foundation in China. Meanwhile,
as the basic data of machinereadable
intelligence in batch
production, it can realize
local and popular attack IOC
coverage. Besides, relying on
vast threat intelligence source
data like historical Passive DNS
and Whois data, 360 ESG is
endowed with efficient capability
to discover threat, associate and
attack sources.
Based on threat intelligence,
360 ESG also owns the firstclass
ability to discover and
track APT groups. According
to the statistics, 38 APT groups
are monitored by 360 in total,
which is the supplier who
published the most APT reports
in China. APT groups firstly
discovered and named by 360
include OceanLotus, APT-C-12,
APT-C-01, etc.
In the year of 2018, 360 threat
intelligence center published
more than 20 technical reports
on APT activity, which involve
six independent APT groups,
including two firstly revealed
groups in 2018, and discovered
two in the wild 0day vulnerability
attack cases, thus taking the
leading position together with
internationally recognized
suppliers.
Such kind of experience
accumulation and strength
demonstration is attributed to
360 ESG threat intelligence
research and analysis team,
which is formed by nearly 100
experts. Specialized talents are
available for all links of threat
analysis, including public
intelligence collection, data
processing, malicious code
analysis, network traffic analysis
and clue mining expansion, thus
providing powerful basic data
and threat assessment support
for improving the ability in
developing security services and
products of threat intelligence.
Till now, 360 ESG has already
published many threat
intelligence products like Alpha
threat analysis platform, threat
intelligence platform - TIP,
threat intelligence platform for
regulatory industry - threat radar,
advanced threat intelligence
analysis services and Cloud
SaaS API, and has been able to
provide customized industrial
solutions for different customers,
thus playing a leading role in the
industry in terms of the delivery
success rate.
In addition, core security products
and services like 360 intelligent
firewall, EDR, NGSOC, situational
awareness, Cloud security and
virtual security are integrated
into the threat intelligence
ability. The machine-readable
intelligence can be rapidly sent
to security devices, formulating
a linkage defense system driven
by threat intelligence. 360 ESG
will make persistent efforts to
demonstrate more excellent
threat intelligence ability in the
future.
Liejun Wang is the Director of
360 threat intelligence center,
with a focus on malware analysis
and APT tracking.
18 Cyber Defense Magazine - Annual Print Edition 2019