Cato Networks launches AI-powered tracker for malware command and control

Cato Networks’ new deep learning algorithms are designed to identify malware command and control domains and block them more quickly than traditional systems based on domain reputation, thanks to extensive training on the company’s own data sets.

Cato, a SASE provider based in Tel Aviv, announced the new algorithmic security system today. The system is predicated on the idea that domain reputation tracking is insufficient to quickly identify the command servers used to remotely control malware. That’s because most modern malware uses a domain generation algorithm (DGA) to rapidly generate pseudorandom domain names — which the deployed malware also has a copy of.

This, essentially, hides the command server from traditional intrusion prevention systems, which would be quick to identify a falsified IP or specific domain name. All a bad actor has to do is register one of the domain names that could be generated by the DGA, and it should be able to evade detection.

Hence, the idea here is to tackle the DGA itself. The company’s algorithm identifies domains that aren’t usually visited by users, but whose names are common to DGAs, including common typographical errors for well-known brands. (e.g., “Microsoftt.com” or similar.) It also applies deep learning to network traffic, which is done remotely in Cato’s cloud to minimize impact on user experience, discovering destination domains and inferring whether or not traffic is malicious.

The use of AI and machine learning in the product is interesting as far as it goes, according to Avidthink principal Roy Chua, but the really exciting news is that this could be the beginning of a trend in malware prevention.

“This is the beginning of [Cato] dynamically blocking an increasing amount of malware,” he said. “And the platform can potentially be used to stop other types of threats — it’s the framework that’s important.”

Part of the reason for the apparent efficacy of Cato’s product, noted Chua, is its use of a broad set of user data collected by the company. While he spoke highly of Cato’s reputation, Chua noted that it’s important to understand exactly what any security vendor is doing with each user’s data.

“It can see all the traffic and it can aggregate all customers,” he said. “If you’re expecting the security vendor to do the hard work for you, you have to put your trust in them, and it’s important for customers to do their due diligence.”

Cato confirmed that the new DGA tracking system would be available to all users of its IPS product immediately, and that it would not change the current pricing structure for its offerings.