Panda Cloud Antivirus www.cloudantivirus.com Pedro Bustamante Senior Research Advisor http://research.pandasecurity.com

Collective Intelligence Panda’s History of Innovation 1998 First daily signature updates 2004 First runtime behavioral analysis TruPrevent 2007 First scanning from the cloud technology Collective Intelligence 2009 First cloud-based antivirus thin-client Panda Cloud Antivirus

Panda Cloud Antivirus is the first cloud-based antivirus thin-client New Security Paradigm Real-time scanning from-the cloud Ultra-lightweight thin-client antivirus Panda Cloud Antivirus is the first cloud-based antivirus thin-client Product bandwidth = initial download + updates + CI + upgrades Calculations based on 1.5 visits per week and 4 pageviews per visit. 3

Panda Cloud Antivirus is the first cloud-based antivirus thin-client On Wednesday, April 29th, Panda is releasing Panda Cloud Antivirus, available for free at www.cloudantivirus.com. Fastest protection against new malware Protection when you need it Incredibly lightweight Community is the Lab FREE Panda Cloud Antivirus is the first cloud-based antivirus thin-client Product bandwidth = initial download + updates + CI + upgrades Calculations based on 1.5 visits per week and 4 pageviews per visit. 4

Heuristics Correlation Over 50.000 new files are imported every day into PandaLabs. These come from customers, competitors, honeypots, CERTs, malicious URLs, online scanners such as VirusTotal, Jotti, etc. Emulation Clustered Grouping New viruses and malware are detected and blocked remotely and automatically almost in real-time without having to send the file to the lab for manual analysis and wait for an answer. The result is that customers are protected against new malware much faster than using traditional signature update approaches. Behavioral Clustered Grafos When a PC protected by Panda encounters a new file which is not detected by local signatures, heuristics or behavioral analysis, its “behavioral traits” are extracted and analyzed remotely by the PandaLabs Collective Intelligence cloud to determine if the new file is malicious or harmless. Sandboxing File Infector Installers Runtime Packers Multi-scanner …I ‘ve represented here the distributed systems of our users, which interact with your infrastructure, managed by PandaLabs, so that (click forward), if a new executable appears, it will provide some basic data (click forward) , such as behavioral traces, date and time of first appearance, and so on. This information alone may not be sufficient to reach a determination, but if we see the same program (click forward) appearing in a different corner of the world, showing a different behavior, we can then correlate those two behaviors and have sufficient evidence…that the program was in fact malware (click forward), and we can instruct the agents (click forward) to block or eliminate the malicious code. Malware does not manifest its behavior all the time, so this approach allows us to become smarter and to detect malware much earlier. This is just an example of the benefits of using this approach. It is important to note that we do not collect personal information, and that based on the specific data we receive, we cannot trace users, you would always need an ISP to be able to do that… In essence, we get global visibility about the activities of malware, and by connecting sensors to our infrastructure we can continuously correlate the different pieces of data, which results in automatic classification of files in a totally transparent fashion. We believe that, most of the times, users cannot take informed decisions when security products ask them what do they want to do with a program. That is why we believe that security should become as a transparent, but always present, component in their computing experience. TRANSITION TO NEXT SLIDE: overcoming the limitations of the predominant model today, the “local” approach, is what we are doing…

Traditional Antivirus Cloud Antivirus Heavy resource consumption Ultra-lightweight cloud agent Detection limited by signature size and RAM Unlimited capabilities hosted in the cloud Multiple layer scanning (transport, storage, execution) Only execution is important. Rest is not dangerous and less priority Signature updates becoming “huge” & easy to bypass Fastest response to newest malware. No visibility for hackers to “test AV” PC isolated from other protected PCs and AV Lab The community is the lab. Each PC = part of client-server community.

Cloud Antivirus – New Protection Model Protection When You Need It Traditional On-Access OnAccess Cloud AV On-Access OnPrefetch OnBackground Entry Vector File System Memory Without Performance Impact Protection When You Need It

Performance Metrics - Internal Beta Industry Avg Cloud AV Memory (WS) 52 MB 17 MB Committed bytes 100 MB 68 MB First boot 60 sec 50 sec Next boots 15 sec 10 sec Performance impact 9% 5% * Performance data based on internal tests 8

Panda Cloud Antivirus www.cloudantivirus.com Pedro Bustamante Senior Research Advisor http://research.pandasecurity.com