Blocking Malware in the Cloud: Does It Work?

Richi Jennings Associates Email: richi@richi.co.uk ? AIM and Skype: richij ? Tel: +44.7789.200701




Blocking Malware
in the Cloud:
Does It Work?
An independent analysis of Trend Micro's cloud-based Web Reputation technology-part of the Trend Micro Smart Protection Network January 9, 2009

This document was independently researched and prepared by Richi Jennings Associates for Trend Micro, Inc.
© 2009 Richi Jennings Associates Blocking Malware in the Cloud: Does It Work?
Executive Summary
As malware becomes ever more sophisticated and resistant to our defenses, the anti-malware industry is faced with the challenges of "signature bloat"-or threat of volume, as Trend MicroT describes it.
After independent analysis, we're convinced by Trend Micro's main claims for its Web Reputation technology-part of its cloud-based Smart Protection Network. It offers better protection and better performance.
In this short report, we outline the increasing challenges raised by the classic way of detecting malware, describe Trend Micro's approach, examine the probable benefits, and discover whether real customers are experiencing these benefits.

Richi Jennings Associates independently conducted all analysis for this document and retained full editorial control. Trend Micro commissioned this white paper with full distribution rights.
Richi Jennings Associates acknowledges all trademarks.
This document is licensed using a Creative Commons Public License, specifically: Attribution-Non-Commercial-Share Alike 2.0 UK: England & Wales. For full details, see http://creativecommons.org/licenses/by-nc-nd/2.0/uk/legalcode
A summary deed with no legal value appears below: You are free to copy, distribute, display, and perform the work under the following conditions: Attribution. You must give the original author credit. Non-Commercial. You may not use this work for commercial purposes. No Derivative Works. You may not alter, transform, or build upon this work. For any reuse or distribution, you must make clear to others the license terms of this work. Any of these conditions can be waived if you get permission from the copyright holder. Nothing in this license impairs or restricts the author's moral rights. Your fair dealing and other rights are in no way affected by the above.
Page 2 © 2009 Richi Jennings Associates Blocking Malware in the Cloud: Does It Work?
Contents

Executive Summary ............................................................................................ 2
1. Introduction .................................................................................................... 4
Background ..................................................................................................... 4
How Web Reputation Works .......................................................................... 4
2. Theoretical Benefits ........................................................................................ 5
Fewer Malware Infections............................................................................... 5
Reduced Overhead .......................................................................................... 5
Improved Performance ................................................................................... 5
Reduced Network Usage................................................................................. 5
3. Actual Results ................................................................................................. 6
Conclusion: Web Reputation Delivers on its Promise ................................... 6
Page 3 © 2009 Richi Jennings Associates Blocking Malware in the Cloud: Does It Work?
1. Introduction
Background Trend Micro was an early innovator in what we now think of as "traditional" antiCmalware technologies. These traditional methods for detecting malware are heavily based around pattern files, which contain unique characteristics or "signatures" of known malware samples. These signatures are researched, extracted, and published by TrendLabs?-Trend Micro's antiCmalware research team.