Charles Kolodgy of IDC has a thoughtful post on SecurityCurrent entitled, Defending Against Custom Malware: The Rise of STAP.
STAP (Specialized Threat Analysis and Protection) technical controls are designed to complement, maybe in the future replace, traditional detection controls that require signatures and rules. STAP controls focus on threats/attacks that have not been seen before or that can morph very quickly and therefore are missed by signature-based controls.
Actors such as criminal organizations and nation states are interested in the long haul. They create specialized malware, intended for a specific target or groups of targets, with the ultimate goal of becoming embedded in the target’s infrastructure. These threats are nearly always new and never seen before. This malware is targeted, polymorphic, and dynamic. It can be delivered via Web page, spear-phishing email, or any other number of avenues.
Mr. Kolodgy breaks STAP controls into three categories:
- Virtual sandboxing/emulation and behavioral analysis
- Virtual containerization/isolation
- Advanced system scanning
Based on Cymbel’s research, we would create fourth category for Advanced log analysis. There is considerable research and funded companies going beyond traditional rule- and statistical/threshold-based techniques. Many of these efforts are levering Hadoop and/or advanced Machine Learning algorithms.
