What is machine learning and how can it be used to detect unknown threats? What makes Symantec’s approach to machine learning different? Defense in depth: Symantec Endpoint Protection 14

1. Part 1: Tackle Unknown Threats with
Symantec Endpoint Protection 14 Machine
Learning
Chris Diya
Systems Engineer
Symantec
5-Part Webinar Series: Endpoint Protection…what really matters?

2. 5-Part Webinar Series: Endpoint Protection…what really matters?
Title: Date:
Part 1 of 5 Tackling Unknown Threats with Symantec Endpoint Protection 14
Machine Learning (Register) January 26, 2017
Part 2 of 5 Block The Risk Of Ransomware (Register) February 23, 2017
Part 3 of 5 Achieving Zero-Day Attacks and What To Do About It (Register)
March 23, 2017
Part 4 of 5 Easy Ways To Improve Your Security Posture (Register) April 20, 2017
Part 5 of 5 A Step-By-Step Approach for Endpoint Detection & Response
(Register) May 18, 2017
https://www.symantec.com/about/webcasts

3. Agenda
Copyright © 2016 Symantec Corporation
What is machine learning and how can it be used to detect unknown
threats?
What makes Symantec’s approach to machine learning different?
Defense in depth: Symantec Endpoint Protection 14

4. What is Machine Learning?
• Training a machine to think like a human analyst!
• Classification of attributes.

5. One of the largest civilian cyber intelligence networks
3.7 Trillion rows of security-relevant data
The Largest Civilian Global Threat Intelligence Network in the World
Diverse data, advanced algorithms, highly-skilled threat experts
5
175M
Consumer and
Enterprise
endpoints
protected
57M
attack sensor
in 157countries
182M
web attacks
blocked last year
Discovered
430 million
new unique pieces
of malware last year
9 threat response centers
Billions
of email traffic
scanned/day
1 Billion
web requests
scanned daily
12,000
Cloud applications
protected
Symantec Endpoint Protection 14

6. Advanced Machine Learning
Copyright © 2016 Symantec Corporation
6
Collect Training sets
in Real-Time
Training Algorithm
Trained Machine
New & Retrained
Adv. ML Classifiers
Detect variant on client
with Advance ML classifiers
The Advanced Machine Learning Engine helps detect more bad files.
– Machine Learning builds a classifier
• Input: Pre-labeled samples
• Output: Classifier that can take unknown samples and produce a percentage guess of
the correct label
– Symantec’s dedicated team of ML scientists and ML experts
– Leverages Symantec’s massive in field presence to gather the best training
data
– Leverages Symantec’s telemetry submissions to verify lab results
Customer Benefit:
 0-day Protection against unknown malware
 Infrequent updates
– The Advanced ML Engine is designed to be incrementally updated which are small and
infrequent.
 High effectiveness.
– Internal tests show very high detection efficacy.

7. Multi-
dimensional
Relationships
cannot be
‘gamed’
Continual
learning
Different user types (power users/novices,
consumer/enterprise) have objects with
differing levels of risk associated with them.
Intelligence from this continues to work very
well even when attackers change tactics
Without any manual retraining, tomorrow’s
protection algorithm evolves to be better than
today’s
Use of deep learning
and neural networks
to continually update
algorithms
Best-in-class characteristics used in our ML .. .. rendering rapidly changing attacks ineffective
Intelligence derived from relationships
Each technique by itself has industry-leading
efficacy. Combined, they are unmatched in
efficacy/false positive results
Relationship-
based ML
Attribute-based
ML
Behavior-based
ML
What Makes Symantec’s Machine Learning Approach Different?
7
Copyright © 2016 Symantec Corporation

8. Copyright © 2016 Symantec Corporation
Superior Protection and Response Across the Attack Chain
Stop Targeted Attacks and Zero-Day Threats with layered protection
INCURSION INFESTATION and EXFILTRATIONINFECTION
ANTIVIRUS
NETWORK
FIREWALL &
INTRUSION
PREVENTION
APPLICATION
AND DEVICE
CONTROL
BEHAVIOR
MONITORING
MEMORY
EXPLOIT
MITIGATION
REPUTATION
ANALYSIS
ADVANCED
MACHINE
LEARNING
EMULATOR
Patented real-time cloud lookup for scanning of suspicious files
NETWORK
FIREWALL &
INTRUSION
PREVENTION
INNOCULATION
POWER ERASER HOST INTEGRITY SYSTEM
LOCKDOWN
SECURE WEB
GATEWAY
INTEGRATION
EDR CONSOLE
(ATP:ENDPOINT)

9. Superior Protection and Response Across the Attack Chain
9
Inbound
Communication
Payload execution
Outbound
Communication
Payload delivery
Next gen IPS
Tamper Protection and Lockdown
Reputation ML
Behavioral ML
Advanced ML *
Anti Virus signatures
Stateful Firewall
Browser protection
Real-time response to rapidly changing threat landscape
Threat vector learning at scale
Next-gen IPS
Application control
Clustering
Emulation*
Signature based Non signature based Machine learning and deep learning
Machine
Learning
Network
Big Data
Hardening
AV
Exploit Protection*
Copyright © 2016 Symantec Corporation
NEW

10. Summary
• SEP14’s Advanced Machine Learning
– An attribute-based detection engine useful for new and evolving threat families.
– More accurate due to the huge sample set obtained from Symantec’s Global Intelligence Network.
• Why Symantec?
– Elite group of machine learning experts
– Lower false positives = more time spent on other things
• Next-gen Defense-in-Depth Endpoint Security
– Machine learning, Memory Exploit Mitigation, Cloud Intelligence
• We’ll be at RSA 2017!
– https://www.symantec.com/about/events/rsa-2017
Copyright © 2016 Symantec Corporation
10

11. Q&A
Copyright © 2016 Symantec Corporation 11