English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Online scanners analyze user-submitted files with a large number of securitytools and provide access to the analysis results. As the most popular onlinescanner, VirusTotal (VT) is often used for determining if samples aremalicious, labeling samples with their family, hunting for new threats, andcollecting malware samples. We analyze 328M VT reports for 235M samplescollected for one year through the VT file feed. We use the reports tocharacterize the VT file feed in depth and compare it with the telemetry of alarge security vendor. We answer questions such as How diverse is the feed?Does it allow building malware datasets for different filetypes? How fresh arethe samples it provides? What is the distribution of malware families it sees?Does that distribution really represent malware on user devices?  We then explore how to perform threat hunting at scale by investigatingscalable approaches that can produce high purity clusters on the 235M feedsamples. We investigate three clustering approaches: hierarchical agglomerativeclustering (HAC), a more scalable HAC variant for TLSH digests (HAC-T), and asimple feature value grouping (FVG). Our results show that HAC-T and FVG usingselected features produce high precision clusters on ground truth datasets.However, only FVG scales to the daily influx of samples in the feed. Moreover,FVG takes 15 hours to cluster the whole dataset of 235M samples. Finally, weuse the produced clusters for threat hunting, namely for detecting 190K samplesthought to be benign (i.e., with zero detections) that may really be maliciousbecause they belong to 29K clusters where most samples are detected asmalicious.

A Deep Dive into VirusTotal: Characterizing and Clustering a Massive File Feed