1. Panda Cloud Antivirus www.cloudantivirus.com Pedro Bustamante
Senior Research Advisor

2. Collective Intelligence
Panda’s History of Innovation
1998
First daily signature updates
2004
First runtime behavioral analysis
TruPrevent
2007
First scanning from the cloud technology
Collective Intelligence
2009
First cloud-based antivirus thin-client
Panda Cloud Antivirus

3. Panda Cloud Antivirus is the first cloud-based antivirus thin-client
New Security Paradigm
Real-time scanning from-the cloud
Ultra-lightweight thin-client antivirus
Panda Cloud Antivirus is the first cloud-based antivirus thin-client
Product bandwidth = initial download + updates + CI + upgrades
Calculations based on 1.5 visits per week and 4 pageviews per visit. 3

4. Panda Cloud Antivirus is the first cloud-based antivirus thin-client
On Wednesday, April 29th, Panda is releasing Panda Cloud Antivirus, available for free at
Fastest protection against new malware
Protection when you need it
Incredibly lightweight
Community is the Lab
FREE
Panda Cloud Antivirus is the first cloud-based antivirus thin-client
Product bandwidth = initial download + updates + CI + upgrades
Calculations based on 1.5 visits per week and 4 pageviews per visit. 4

5. Heuristics
Correlation
Over new files are imported every day into PandaLabs. These come from customers, competitors, honeypots, CERTs, malicious URLs, online scanners such as VirusTotal, Jotti, etc.
Emulation
Clustered Grouping
New viruses and malware are detected and blocked remotely and automatically almost in real-time without having to send the file to the lab for manual analysis and wait for an answer. The result is that customers are protected against new malware much faster than using traditional signature update approaches.
Behavioral
Clustered Grafos
When a PC protected by Panda encounters a new file which is not detected by local signatures, heuristics or behavioral analysis, its “behavioral traits” are extracted and analyzed remotely by the PandaLabs Collective Intelligence cloud to determine if the new file is malicious or harmless.
Sandboxing
File Infector
Installers
Runtime Packers
Multi-scanner
…I ‘ve represented here the distributed systems of our users, which interact with your infrastructure, managed by PandaLabs, so that (click forward), if a new executable appears, it will provide some basic data (click forward) , such as behavioral traces, date and time of first appearance, and so on. This information alone may not be sufficient to reach a determination, but if we see the same program (click forward) appearing in a different corner of the world, showing a different behavior, we can then correlate those two behaviors and have sufficient evidence…that the program was in fact malware (click forward), and we can instruct the agents (click forward) to block or eliminate the malicious code. Malware does not manifest its behavior all the time, so this approach allows us to become smarter and to detect malware much earlier. This is just an example of the benefits of using this approach.
It is important to note that we do not collect personal information, and that based on the specific data we receive, we cannot trace users, you would always need an ISP to be able to do that…
In essence, we get global visibility about the activities of malware, and by connecting sensors to our infrastructure we can continuously correlate the different pieces of data, which results in automatic classification of files in a totally transparent fashion. We believe that, most of the times, users cannot take informed decisions when security products ask them what do they want to do with a program. That is why we believe that security should become as a transparent, but always present, component in their computing experience.
TRANSITION TO NEXT SLIDE: overcoming the limitations of the predominant model today, the “local” approach, is what we are doing…

6. Traditional Antivirus
Cloud Antivirus
Heavy resource consumption
Ultra-lightweight cloud agent
Detection limited by signature size and RAM
Unlimited capabilities hosted in the cloud
Multiple layer scanning (transport, storage, execution)
Only execution is important. Rest is not dangerous and less priority
Signature updates becoming “huge” & easy to bypass
Fastest response to newest malware. No visibility for hackers to “test AV”
PC isolated from other protected PCs and AV Lab
The community is the lab. Each PC = part of client-server community.

7. Cloud Antivirus – New Protection Model Protection When You Need It
Traditional On-Access
OnAccess
Cloud AV On-Access
OnPrefetch
OnBackground
Entry Vector
File System
Memory
Without Performance
Impact
Protection When You Need It

8. Performance Metrics - Internal Beta
Industry Avg Cloud AV
Memory (WS) 52 MB 17 MB
Committed bytes 100 MB 68 MB
First boot sec 50 sec
Next boots 15 sec 10 sec
Performance impact 9% 5%
* Performance data based on internal tests 8

10. Panda Cloud Antivirus www.cloudantivirus.com Pedro Bustamante
Senior Research Advisor