SANDS Lab Previews CTX, Its Next-Generation Threat Intelligence Brand

SANDS Lab Previews CTX, Its Next-Generation Threat Intelligence Brand

• A completely redesigned service built on SANDS Lab’s AI and big data strengths
• Responding to market demands for more affordable intelligence
• A renewed intelligence brand combining X to represent evolving threats

SANDS Lab developed and launched malwares.com in 2014 despite widespread opposition. Over nine years it analyzed approximately 37.6 billion threat records and used around 2.2 billion malware samples. Generating KRW 6 billion in annual revenue, it became a key service and source of added value. With malwares.com leading its business, SANDS Lab became Korea’s leading CTI provider and listed on KOSDAQ in February this year.

Through ESG management, SANDS Lab also made the best possible social contribution using its data. Its three main contributions are preventing large-scale cyberattack proliferation through feeds, providing expert-level analysis, and supplying large datasets for AI development.

Meanwhile, global standards rise daily and market demands continue to grow. As systems, society, and markets evolve, limitations of malwares.com persistently emerge, requiring improvements to meet changing needs.

After several years of work, SANDS Lab created CTX, a threat intelligence service completely redesigned around its strengths in AI and big data. Combining CT for Cyber Threat with the variable X, the upgraded brand encompasses eXpert, eXchange, conteXt, and the changing dimensions of threats.

Completely Rebuilt, AI-Based Next-Generation Intelligence

malwares.com originally built intelligence from malware analysis, using extracted information to classify files as malicious or benign and identify relationships. The focus has now shifted from malware to attackers and threat intelligence.

SANDS Lab rebuilt its intelligence architecture so defenders can address current APT attacks by comprehensively understanding targeted countries and industries, attacker campaigns, and the IoCs used in them.

It reconstructs the full context from attacking countries, tools, related malware, target countries and industries, as well as states behind attack groups, vulnerabilities, and indicators of compromise. Threat context must enable responses informed by the diverse information behind an attack.

The datasets for CTX therefore form knowledge graphs backed by as many objective facts as possible, beyond simple links. They explain why IP addresses, domains, and files are related, helping interpret threats and their significance. They can also underpin future cybersecurity AI such as LLMs and XAI.

Two core technologies played major roles: attack-group and technique profiling for executable binaries and for non-executable document files. They received New Excellent Technology certification from Korea’s Ministry of Trade, Industry and Energy in 2021 and 2022, respectively.

The technologies demonstrated their potential at the recent VB2023 in London, and SANDS Lab expects them to stand out at upcoming global conferences such as AVAR in Dubai.

Affordable Intelligence That Reflects Market Needs

Intelligence services are expensive. Unlike antivirus or security products, their information-based value is intangible, costly, and difficult to use, limiting market growth. CTX began with the concept of making intelligence more affordable.

Different providers offer different interpretations according to their data and analysis capabilities, increasingly confusing analysts. SANDS Lab researched large volumes of intelligence, using AI to select reliable data, and found that strengths concentrate in particular areas.

It concluded that combining only each provider’s strongest intelligence, rather than everything each site offers, would enable economical, one-stop threat identification and assessment.

Entering an intelligence service’s key automatically integrates and consolidates information for cross-checking, producing ready-to-review and report data without separate collection or integration work. Integration with widely used providers such as VirusTotal, Alien Vault, and Criminal IP is being prepared.

Intelligence as a Foundation for the Future

Next-generation cybersecurity AI requires datasets. Quality datasets enable quality models, but acquiring large volumes at the outset is difficult for small businesses, startups, and large enterprises alike.

Building datasets requires metadata derived from diverse feature-based attributes, which is difficult without expertise or analyzers for particular metadata. SANDS Lab therefore selects quality data from its accumulated collection and analysis and makes it available for AI.

Datasets cover various file types and support organizational benchmarking (BMT) as well as AI. Identifying personal or corporate information is de-identified and reprocessed without impairing AI training. The entire CTX process is automated, with new samples added monthly.

This dataset sales model is new to Korea’s cybersecurity industry. With its diverse datasets, SANDS Lab expects to establish an important turning point where data itself becomes a product.

Previewed that day to media and industry representatives, CTX is scheduled for its official launch on the 15th.