We have developed over the course of the entire project several new technologies:
- A NanoOS (live hypervisor) capable of monitoring security activities from outside the operating system, this approach guarantees a strong resilience of the monitoring system that cannot be easily disabled by the attackers to prevent tracking and it's also immune to evasion attempts.
- A live agent capable of working on different platforms: Windows, Mac OS, Linux and Android. The agent is a highly sophisticated component that gathers security information from every device and translates it to a single and unified format, independently from the platform it's working on.
- A dedicated dashboard capable of managing every stage of the cyber-kill chain: identification of the attack, tracking, protection, mitigation, eradication and reporting.
- A dedicated Multi-tenant platform to allow access to the same infrastructure from several unrelated parties, guaranteeing data segregation. This has been done in order to enable security partners to offer the solution as a service to those customers unable to afford the infrastructure required to acquire and process security data.
- A highly scalable backend that can easily transition from a small installation capable of handling few hundred endpoints to an installation capable of handling hundred of thousands devices simply by adding computational power and without requiring any complex setup
- A series of Artificial Intelligence engines capable of analysing all the aspects of the cyber-kill chain. This includes real-time behavioral analysis of activities coming from the endpoint, infrastructural analysis of internal and infrastructural interaction, time-based analysis of multiple events such as user logins, access to network resources etc
- A set of engines capable of ensuring automated protection at different levels: we developed a dedicated and machine-learning driven anti-ransomware engine, to prevent data tampering and destruction. A set of engines dedicated to behavioral policing capable of blocking specific and generic behaviors without impeding the usage altogether of a certain application. A set of engine for the detection and protection of kernel level exploits
- A dedicated customisation engine capable of creating new kind of detections, automation and policing on-the-fly and completely in real-time. This engine ensures that customers can add their own detection/protection/response/management playbook within the solution itself
- A dedicated machine-learning engine for on-device and real-time detection of threats on mobile phones (Android)
- A comprehensive threat hunting platform to allow user to run proactive threat hunting campaigns, aimed at detecting malicious behaviors and dormant threats that might have gone undetected by the behavioral engines.
- An Artificial Intelligence based supply-chain attack detection system capable of understanding when trusted software is behaving in potentially malicious ways after receiving updates.
During the development cycle the results of our works have always been constantly reported on our website and by participating to relevant security conferences in our region of interest. ReaQta remains always active in the dissemination of knowledge and our blog shows the results achieved while using our solution in real environment, this includes analyses of new kind of threats and cyber intelligence related to threat actors and their activities worldwide. We also communicate our results on platforms like Twitter and Linkedin.
