Symantec Ubiquity

The Symantec corporation announced Ubiquity start [Yubikviti – engl. "omnipresence"] - security technologies of new generation for protection against the evolving malware. This technology is based on reputation of files of community of users of products of Symantec. Being result of more than four years' work, Ubiquity gives the chance of Symantec to collect anonymous information on features of use of software by more than 100 million clients of Symantec and also to provide protection against the uzkorasprostranenny, changing threats which, otherwise, would not be covered by traditional solutions in the field of security at all.

Traditional approach to security demands from suppliers of antivirus software of preliminary determination and the analysis of characteristic signs of malware before they are able to offer protection against them. But only for 2009 the Symantec company detected 240 million unique versions of malware. On average, each of such programs extends on less than 20 computers, and many were detected only on one computer in the world. This fact almost completely excludes possibilities of antivirus software of other suppliers to find, analyze and provide protection against really all possible security risks and also throws down a serious challenge to traditional approaches to determination of malware.

The Ubiquity technology uses essentially a different approach to help to provide security blanket of infrastructure and customer information of Symantec from the newest and purposeful threats.

Main Advantages

• Identifies the threats which are not determined by other technologies of protection – Ubiquity provides absolutely new layer of protection which enhances the principle of echelon defense (defense-in-depth) used by Symantec which includes also protection on the basis of signatures, an intrusion prevention system, heuristics and the analysis of behavior of applications. Ubiquity defines the security level of each file, based on information on a file context: from where it arrived how long it is created what characteristics of a propagation path of the file among clients of Symantec and also in addition makes specialized calculations. As virus writers can easily modify contents of the file of the malware to bypass the protection based on virus signatures, traditional means of protecting it becomes difficult to control such wave of the malware. Ubiquity is the only technology in the industry which uses similar approach to determination of such threats.
• Performance improvement up to 90% – Ubiquity lowers system loading when scanning almost by 90%, scanning only those files which were defined as risky. As a result, anti-virus scanning happens much quicker since the number of the analyzed files is reduced, and the quality of protection increases.
• Reduces the number of false operations and overheads – Ubiquity contains not only data on malware, but also and ratings for almost all licensed programs provided on the Internet that does Ubiquity by one of the biggest lists of the checked software (so-called clean sheets). Products of Symantec are used by this list for acceptance of more reasoned decisions when blocking files that significantly reduces the probability of false operations when scanning applications.
• Provides effective protection according to security policies of the enterprises – Data which are provided by Ubiquity, can be used for providing control of software to administrators of tools which enters an environment of their users, at the expense of simple and manageable file the politician which consider the ratings of security of files, degree of their prevalence and date of their detection.

In a basis: reputation these communities of users

Ubiquity is the first technology which uses collective data of more than 100 million computer systems of clients of Symantec which were signed for this service and also security given to a global network of knowledge of Symantec (Global Intelligence Network) for high-precision determination of rating (good, neutral and bad) almost for all existing electronic files. At the moment, Ubiquity contains the ratings of security more than 1.5 billion different applications that does her by the big similar database in the world. It gives the chance of Ubiquity to provide reliability of computer systems in the conditions of a modern boom of the purposeful modified malware, including the threats generated "on the fly" and affecting only one user in the world.

After successful implementation of Ubiquity in a product line for protection of users of Norton 2011, and later and in Symantec Hosted Endpoint Protection, the Symantec company prepares for integration of Ubiquity into a broad spectrum of corporate products that will be made within the next year. Symantec Web Gateway will become the first such product.

Results

From the moment of the primary start, the Ubiquity technology already showed impressive results:

• The reputation Ubiquity database contains the correct ratings more than 1.5 billion "good" and "bad" started files, and continues to fill up this array with new data with speed of 22 million files a week. This information is based on completely automated and anonymous feedback about use of software which arrives from more than 118 million computers of the clients of Symantec participating in the program.
• Using data of Ubiquity, defined Symantec that more than 75 percent of malware influence work of less than 50 users of Symantec. These statistical data testify to a trend of distribution of highly effective purposeful threats which affect a narrow segment of users and also show the need for reputation technology, such as Ubiquity, for ensuring protection against similar malware.
• Ubiquity, on average, processes more than 45 billion requests a month for providing rating of security of programs from clients of Symantec.
• The Ubiquity technology was recognized recently by the winner in category of network security systems according to Wall Street Journal 2010 Technology Innovation Awards.