De la I.A. la calcul paralel, pentru un univers cibernetic mai sigur. Prezentare tinuta la UPB, Facultatea de Automatica si calculatoare pe 27 Feb 2010.

1. Click to edit Master title style
• Click to edit Master text styles
– Second level
De la I.A. la calcul paralel,
• Third level
pentru un univers cibernetic
– Fourth level
» Fifth level
mai sigur
Costin G. Raiu
Chief Security Expert, Kaspersky Lab EEMEA
craiu@kaspersky.ro
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

2. Click to edit Master Numiti
title style virusul!
• Click to edit Master text styles
– Second level
• Third level
– Fourth level
» Fifth level
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

3. 1988
Click to edit Master title style
Efectul grafic din
• Click to edit Master text styles
stanga era afisat de
– Second level
• Third level
catre virusul:
– Fourth level
» Fifth level •Melissa
•CodeRed
•DenZuk
•Michaelangelo
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

4. 1991
Click to edit Master title style
Efectul grafic din
• Click to edit Master text styles
stanga era afisat de
– Second level
catre virusul:
• Third level
– Fourth level
» Fifth level •Jabber
•Tequila
•BadSectors
•One_Half
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

5. 1999
Click to edit Master title style
Efectul grafic din
• Click to edit Master text styles
stanga era afisat de
– Second level
• Third level
catre virusul:
– Fourth level
» Fifth level •CodeRed
•Melissa
•Happy99
•Cascade
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

6. 2000
Click to edit Master title style
Dis is one half.
• Click to edit Master text styles
– Second level
Press any key to continue...
• Third level
– Fourth level
» Fifth level
Ce virus afiseaza mesajul de mai sus dupa ce a
criptat 50% din datele de pe HDD:
a) NetSky b) OneHalf
c) Ebola d) 50 Cent
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

7. 2003
Click to edit Master title style
• Click to edit Master text styles
– Second level
• Third level
– Fourth level
» Fifth level
Cum se numeste virusul de mai sus?
a) MyDoom b) MyTob
c) Rbot d) Blaster/Lovesan
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

8. 2010
Click to edit Master title style
Evolutia numarului de programe
• Click to edit Master text styles
‘malware’: 2003-2010
– Second level
• Third level
– Fourth level
» Fifth level
Exista peste 40 milioane programe ‘malware’ in acest moment
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

9. Click to edit Master title style2010
In
• Click to edit Master text styles
• Nu mai exista analisti capabili sa recunoasca
– Second level
orice virus uitandu-se doar la sursa acestuia
• Third level
• Analiza Fourth level a fiecarui virus nou este
– manuala
imposibila Fifth level
»
• Locul analistilor este luat de sisteme expert,
care analizeaza automat programele
periculoase
• Peste 90% din fisierele noi sunt modificari si
noi generatii ale unor virusi cunoscuti
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

10. Sa facem
Click to edit Master title style o paralela
• Click to edit Master text styles
– Second level
• Third level
– Fourth level
» Fifth level
8 TB
100 TF - PF
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

11. Click to edit Singularitatea
Master title style tehnologica
• Click to edit Master text styles
– Second level
• Third level
– Fourth level
» Fifth level
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

12. Click to edit Singularitatea
Master title style tehnologica
• Click to edit Master text styles
2010: Supercalculatoarele vor atinge puterea
– Second level de calcul a creierului uman (desi nu va exista
• Third level software-ul corespunzator pentru a-l emula)
– Fourth level
» Fifth level
2020: Calculatoarele personale vor atinge
puterea de calcul a creierului uman
2030: Upload/download neural
2045: Singularitatea tehnologica
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

13. Kaspersky
Click to edit Master title style Lab
• Click to edit Master text styles
• Focus pe analiza automata a noilor variante
– Second level
ale unui malware cunoscut
• Third level
• Trei pasi importanti:
– Fourth level
» Fifth level
– “Feature extraction”
– “Similarity index”
– “Family Clustering”
• Aplicati peste:
– Fisierul binar
– Log-ul de executie
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

14. Click to edit Master title styleautomata
Analiza
• Click to edit Master text 89 41 0C 8B 45
89 41 08 styles 03 7C EB 48 2C E9 C3 D5
CC CC CC CC CC 8B FF 55 8A 2B 4B B6 E6 3C 95 A2
– Second level A1
FF
18
FF
31
00
E0
89
6C
45
83
FC
A5
8B
F8
45
3A 36 51 B0 38 5B 86 3A
FF FF 00 89 45 FC 8B 45
30 89 85 F0 FE FF FF 8B
• Third level 8B DE 75 32 8A 46 01 84
EB 67 AA 27 EF 70 E2 E7
FC F9 28 9A B3 1A 14 AA
– Fourth level C0 50 FF 15 E8 11 DF 6C 9D 2B 92 27 D3 FD E9 BD
FF FF 02 00 00 00 8D 5E A4 CE 77 15 97 D7 72 32
» Fifth level FF 85 C0 74 06 43 80 3B 5D 58 7B EB 0F 0F 43 77
FF 8B C3 2B C6 2B C2 3D D5 71 A9 00 62 3E CD 70
F8 FE FF FF 4E 01 0C 80 30 06 C1 01 A1 C6 2C FE
D1 C1 E9 02 8D BD FC FE 73 D3 0C 0F 94 E4 74 98
03 F3 A4 C6 84 05 FC FE 5B FD A5 45 0E 39 06 D1
FF 50 33 C0 39 85 F4 FE 27 19 D2 CB 35 5D 59 72
FC FE FF FF 50 FF 15 BC 6B BE CC 6A DB 6F 54 81
C7 85 F8 FE FF FF 4F 01 FF 50 33 C0 39 85 F4 FE
FF FF 8B 8D E8 FE FF FF ...
0C 8B 85 EC FE FF FF 89 DE 99 93 93 CC A9 14 59
FF FF 5E 5B E8 D3 E4 00 AE 7A 3D 79 19 67 C0 33
CC CC 8B FF 55 8B EC 51 4B 63 48 17 69 40 5E 3B
33 DB 3B C3 89 5D FC 75 39 19 E5 CA D1 11 18 1F
EB 36 56 57 33 FF 39 18 E0 B4 4F DA 9D 0E 17 9D
Feature extraction Similarity index
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

15. Paralelizarea
Click to edit Master title style cautarilor
• Click to edit Master text styles
– Second level
• Third level
– Fourth level
» Fifth level
“The NVIDIA® Tesla™ S1070 Computing System
(Dual PCI Express 2.0 cable connections) is a four-
teraflop 1U system powered by the world’s first one-
teraflop processor.”
De 360 ori mai rapid ca un sistem cu Intel Core 2 Duo la 2.6Ghz
http://www.kaspersky.com/news?id=207575979
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

16. Click to edit Master title Concluzii
style
• Click va edit Master text de important pentru
• 2010 to fi un an extrem styles
Inteligentalevel
– Second Artificiala si C.P.
• Noile Third level de calcul paralel permit analiza
• tehnologii
rapida a noilor amenintari informatice in mod
– Fourth level
automat » Fifth level
• Cuplate cu software dedicat, acestea pot oferi solutii
de protectie superioare celor scrise manual de catre
analisti
• Nu stim exact cand va aparea prima I.A., insa speram
ca aceasta ne va ajuta in lupta impotriva
amenintarilor informatice 
AI-MAS Winter Olympics 2010 – Bucuresti, Feb 27, 2010

17. Click to edit Master title style
• Click to edit Master text styles
– Second level
• Third levelMultumesc!
– Fourth level
» Fifth level
Intrebari?
twitter.com/craiu
www.kaspersky.ro