Introduction to PolySwarm
- 2. Steve Bassi CEO Ben Schmidt CSO Paul Makowski CTO Nick Davis COO Background ➔ Built high-end R&D consultancy with projects for: DARPA, DHS, Fortune 200… ➔ Threat-hunted nation states in world’s largest enterprises, frustrated by difficulty of tool deployment and reuse ➔ Co-founded & built PolySwarm to 25 employees to rethink threat detection
- 3. 1.5 million security expert shortage projected by 2019 26-47% of threats go undetected by the average antivirus 32% increase in new malware vs prior year Malware Growth Low AV Effectiveness Talent Shortage Silver Bullet-Proof Problem GData Security Blog RAP Proactive Symantec
- 4. Inadequate Model Single-Vendor, Centralized Protection Model 1. Overlapping coverage = wasted effort 1. Solutions not cross-compatible 1. Hard to combine specialized offerings 1. Lack of market transparency coverage overlap not compatible AV 2AV 1 traditional threat landscape blind spot AV 1
- 5. Competitive Threat Detection Combine Global Experts Into A Single Access Point
- 6. The Product Decentralized Threat Detection Marketplace User submits artifact Multiple Experts’ software 1. Analyzes artifact 2. Predicts artifact malintent 3. Stakes prediction with money 4. Collects spoils for job well done Rinse and repeat, per- artifact, millions of times per day
- 7. Consumer Benefits Improvements to Threat Detection Paradigm PolySwarm threat landscape Expert A AV Company B 1. Competitive response = higher signal Speculators need not apply 1. Broader coverage via pressure to specialize, commoditization of widely known threats 1. Reputational transparency drives industry forward 2. Privacy & anonymity
- 8. Generate passive income A true meritocracy with lower barriers to entry Access to a vast stream of malware samples and analytics Access to a large market Supplier Benefits A Fair Playfield To Monetize Specialized Expertise
- 9. “PolySwarm's prediction market is one of the most novel ideas seen on threat intelligence space” “PolySwarm provides a better detection rate for consumers and immediate feedback to anti-malware services to improve their products.” “We look forward to expanding our coverage with PolySwarm’s and consuming the marketplace’s threat intelligence feeds” “The ability to generate passive income is what drew us to PolySwarm’s marketplace.” Why PolySwarm “PolySwarm offers a major R&D advantage as we get the opportunity to continuously test and develop our system in a real-world environment” “ PolySwarm’s decentralized platform provides a new way to protect the internet”
- 10. Competitive Threat Detection Prediction Market Applied
- 11. Bounties Offers BOUNTY ➔ Have: money, streams of suspect artifacts (files, URLs, traffic) ➔ Want: accurate, timely protection for their users and IP ➔ Why PolySwarm? higher utilization of subscription dollar, broader right-fit coverage Enterprises
- 12. Bounties Offers BOUNTY GROUND TRUTH ➔ Have: expertise in identifying badness in files, urls, and network traffic (artifacts), up to date intel on their slice of the malware landscape ➔ Want: compensation for providing intel ➔ Why PolySwarm? broad customer access point that rewards codified threat detection Experts
- 13. BOUNTY GROUND TRUTH ➔ Have: enterprise customers, accuracy data for PolySwarm security experts ➔ Want: compensation for turnkey Enterprise solutions ➔ Why PolySwarm? current expertise, enabling better response to customer threats MSSPs Bounties Offers
- 14. Bounty Example
- 15. Today’s Edge Suppliers antivirus companies antivirus companies & diverse security experts Coverage must deliver overlapping core coverage incentivizes specialization Economic Incentives None rewards & penalties based on accuracy Barrier to Entry engine with broad coverage, established customer base no restrictions; anyone with codified threat detection software can participate Privacy customers can see everything from anyone anonymous participation + private communities
- 16. Tomorrow’s Vision Competition <> Edge, Better User Protection
- 17. Tool Integration Mail servers for blocking dangerous attachments SaaS services that handle potentially dangerous uploads Appliances and endpoint agents that protect users directly Bring Competitive Threat Detection To Allow/Block Enforcers
- 18. Democratized Data Asset Leverage malware data and modeling to target/price cyber risk insurance Broad training for competing ML micro-engines Real ROI data for security dollars spent Distributed Detection, Single Point Of Aggregation
- 19. Expert Care and Feeding Expert reputation and dimensional performance stored in a immutable ledger Encourage specialization by highlighting unmet artifact demand (e.g. Android APKs) Distribute micro-engines directly to the enterprise edge Community Growth And Expert Promotion Holds Key To Matchmaking
- 20. More consumers attract more suppliers More suppliers attract more consumers Stimulate Network Effects Growth Plan 1. Integration into existing: a. Incident response (IR) tools b. Security Appliances c. Anti-virus regimes 1. Engine and Channel Partnerships 1. Financial grants to individual security experts 1. ‘Matchmaking’ approach for Supply<>Demand
- 21. Suppliers of threat detection
- 22. 1.5 million security expert shortage projected by 2019 26-47% of threats go undetected by the average antivirus 32% increase in new malware vs prior year Malware Growth Low AV Effectiveness Talent Shortage Problem<>Solution GData Security Blog RAP Proactive Symantec PolySwarm connects high-value talent to high-value companies
- 23. 1.5 million security expert shortage projected by 2019 26-47% of threats go undetected by the average antivirus 32% increase in new malware vs prior year Malware Growth Low AV Effectiveness Talent Shortage GData Security Blog RAP Proactive Symantec In PolySwarm, vendors specialize, together providing comprehensive coverage PolySwarm connects high-value talent to high-value companies Problem<>Solution
- 24. 1.5 million security expert shortage projected by 2019 26-47% of threats go undetected by the average antivirus 32% increase in new malware vs prior year Malware Growth Low AV Effectiveness Talent Shortage GData Security Blog RAP Proactive Symantec In PolySwarm, vendors specialize, together providing comprehensive coverage PolySwarm connects high-value talent to high-value companies PolySwarm continuously evolves as experts adapt to new threats Problem<>Solution
- 26. polyswarm.io
Editor's Notes
- #4: And we think you see the consequences of this frustration everywhere Lots of innovative tools out there but both the amount of malware and the damage done by it keep growing Also, the cyber insurance market keeps growing which means our tech industry efforts aren’t effective as we’d like re shortage, that 1.5M figure is 320k in the US alone according to NSA, 1M in US by 2020
- #5: And we think the way we buy cyber security tools and expect them to protect us is actually to blame Once a year symantec, kaspersky, mcafee all go into a room and pitch their products Those products all cover the threat bell curve in different ways, some focus on the tails, others on the middle This means some coverage overlaps, some doesn’t, and there is no way to combine all those vendors into one protective umbrella and just pay for what you use
- #6: So we were already frustrated that we couldn’t get our special snowflake tools into wide distribution in our enterprise threat hunting days. And we felt like we (TODO) paul brainstorm: global experts, single access point global expertise, one access point simple, scalable access to global expertise global expertise at scale global expertise, one interface
- #7: So we built this playing field for threat detection competition. And at a very high level it works like this. Now you’re probably wondering about D, how do we divide the spoils for a job well done well that is where we leverage something called a prediction market <tell them about prediction market>. paul notes: “at line speed” “at machine speed” micro-transactions
- #11: TODO: describe
- #12: TODO: faster through these
- #16: Where we are today is approaching virus total in feature parity. We act as that single access point for predicting malintent in artifacts and really change the game on the data behind that prediction. So today we pretty much operate in cloud AV mode.
- #17: TODO: describe
- #27: demo script: go to polyswarm.network upload a benign file search that benign file by hash log in upload EICAR view microengines page curl against consumer (api key in env var) run a microengine, point at polyswarmd?