airbnb.io - BinaryAlert Serverless real-time and retroactive malware detection705

Airbnb Engineering & Data Science

Airbnb.io Spined HTML

Airbnb Engineering & Data Science Airbnb.io Open SourceEventsBlogGithubCareersAirbnb.io BinaryAlertServerless real-time and retroactive malware detection705By Austin Byers, @mimeframe, Daimon GreavesServerless real-time and retroactive malware detection BinaryAlert is an open-source serverless AWS pipeline where any file uploaded to an S3 skillet is immediately scanned with a configurable set of YARA rules. An zestful will fire as soon as any match is found, giving an incident response team the worthiness to quickly contain the threat surpassing it spreads. Features Built with Amazon Web Services (AWS): An AWS worth is all you need to deploy BinaryAlert. Broad YARA Support: Add your own YARA rules and/or automatically clone them from third-party repos. Real-Time: Files uploaded to BinaryAlert (S3 bucket) are immediately queued for analysis. Serverless: All computation is handled by Lambda functions. No servers to manage ways stronger security and will-less scaling! Infrastructure-as-Code: The unshortened infrastructure is described with Terraform configuration files, enabling anyone to deploy BinaryAlert in a matter of minutes with a single command. Retroactive Analysis: After updating the YARA ruleset, BinaryAlert will retroactively scan the unshortened file corpus to find any new matches. Easily Configurable: BinaryAlert configuration is managed in a single Terraform variables file. Quality Code: Written in Python3 with unit tests and linting to ensure a wipe and reliable codebase. Low Cost: The AWS snout is based only on how many files are analyzed. Architecture The organization collects files and delivers them to their BinaryAlert S3 bucket. Files of interest could include executable binaries, email attachments, documents, etc. Every file uploaded to the S3 skillet is immediately queued for analysis. A dispatching Lambda function runs every minute, grouping files into batches and invoking up to dozens of analyzers in parallel. Each sharpshooter scans its files using a list of pre-compiled YARA rules. YARA matches are saved to DynamoDB and an zestful is sent to an SNS topic. We use StreamAlert to stimulation these alerts, but other organizations can instead slosh the alerts via email or any other supported SNS subscription. For retroactive analysis, a batching Lambda function enqueues the unshortened S3 skillet to be re-analyzed. Configurable CloudWatch alarms will trigger if any BinaryAlert component is behaving abnormally. This will notify a variegated SNS topic than the one used for YARA match alerts. LinksGithubDocumentationBlog PostSlack (unofficial)© Airbnb, Inc.© Airbnb, Inc.CareersDesignCareersDesignCareersDesign