topic Spero and ETHOS in Endpoint Security

Spero and ETHOS

llomjaria — Wed, 26 Oct 2022 14:34:00 GMT

Hello,

I am just getting familiar with Secure Endpoint and would like to know more about Spero and Ethos engine.

I could not find DETAILED information about how these engines work and what they do.

Would be grateful if someone provides documentation.

Thanks

Re: Spero and ETHOS

Ken Stieers — Wed, 26 Oct 2022 14:48:05 GMT

https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2020/pdf/DGTL-BRKSEC-3446.pdf
specifically page 53 of that PDF.

Re: Spero and ETHOS

llomjaria — Thu, 27 Oct 2022 06:42:15 GMT

Thank you for the information.

It's useful but not as detailed.

Re: Spero and ETHOS

Troja007 — Wed, 02 Nov 2022 19:21:10 GMT

Hello @llomjaria ,
enclosed some infos:

SPERO (Machine Learning): We use hundreds of infos of a file, which we call a SPERO fingerprint. This is sent to the cloud and SPERO trees determine whether a file is malicious. Note, a Spero Hash is a hash based on file characteristics, not the file itself

ETHOS (File Grouping): The engine is designed to detect polymorphic threats by checking specific characteristics of a file. Much malware tries to pack/unpack/re-pack to change itself and to hide from detection. The engine is detection such activity and is able to "group" an unknown file based on its behaviour to a known malware family.

Greetings,
Thorsten