Big Data Made Small

That which was surprising to all of us could be that the 20-years old Polish adware and spyware Prosiak 65 was probably the most prevalent virus trigger detected by our sensors throughout the preceding six-month period. Throughout the presentation, the Fortinet presenter flagged this statistic was anomalous, and indicated towards the audience he had discussed it having a Fortinet Data Researcher to ensure the data.

We view this same adware and spyware jump onto the top five Global Adware and spyware list within our FortiGuard Threat Set of multiple occasions (30th June 2017 and 24th November 2017), why would a defunct virus sample from almost twenty years ago make this type of major appearance within our world-wide stats?

Beware the Walking Dead

Prosiak 65 is really a adware and spyware which was first seen almost twenty years ago. Just like many older adware and spyware, additionally, it remains in circulation. As the overall prevalence of Prosiak 65 has declined across locations, we've and then see repeated activity - together with a spike during 2018 and through the current six several weeks.

There's a couple of explanations why a classic bit of adware and spyware like this can be triggering our systems:

• It might be genuinely still active (by active, we mean being seen by our Audio-video engine, why it's active is really a different question).
• It might share components having a newer strain of adware and spyware that our signatures are triggering
• It might be an incorrect positive

To find out which of those reasons apply, the Fortinet threat research team has investigated this in additional depth, and believes the signature W32/BackDoor.Prosiak.65 is properly identifying the sample found here on VirusTotal. From your in-house testing we've proven that, while early, this adware and spyware can continue to run and infect files on Home windows XP and Home windows 7 systems.

Our analysis from the data has proven that although the recognition spike has elevated levels of volume, it's lower in prevalence. For instance, within our Threat Landscape Report for Q4 2017, Prosiak 65 was seen on under 1% of companies. So when measured during the last thirty days, we view it on under 1,000 devices. However, the entire quantity of detections in that same there was a time around 665,000 hits, with the majority of the causes of individuals detections being in the systems a lot of our largest ISP customers, without any specific concentrate on region or industry. The precise causes of this consistent amount of triggers is unclear at the moment, and we're still investigating the origin.

With more than 5 million devices offered worldwide, a trigger from just 1,000 devices sounds trivial. However, 665,000 hits isn't. The task we face when presenting similarly info is presenting it inside a consistent manner and putting it into context in order to be helpful. We have to make sure we're not governing the data to appear convenient, or aren't bending it towards the message we are attempting to get across, and that's why we make use of a peer-review process to guarantee the precision of knowledge and how it's being presented.

Conclusion

May be the information wrong? We don’t believe so, although we're still investigating. We all do, however, think the ranking is skewed by a lot of triggers from the relatively few devices. We chose to make this very reason for the SEMAFOR conference.

Will it need further analysis? Without a doubt any anomalous information such as this is scrutinized by our data scientists and FortiGuard Threat Research team therefore we can find out more.

Do we have to take a look at the way we present our data? Potentially, however, we don't want to exclude information to really make it easier and fit a story.