DOCSLIB.ORG

Real-Time Detection of Dictionary DGA Network Traffic Using Deep

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Real-Time Detection of Dictionary DGA Network Traffic Using Deep SN Computer Science (2021) 2:110 https://doi.org/10.1007/s42979-021-00507-w ORIGINAL RESEARCH Real‑Time Detection of Dictionary DGA Network Trafc Using Deep Learning Kate Highnam1 · Domenic Puzio2 · Song Luo3 · Nicholas R. Jennings1 Received: 1 August 2020 / Accepted: 6 February 2021 / Published online: 22 February 2021 © The Author(s) 2021 Abstract Botnets and malware continue to avoid detection by static rule engines when using domain generation algorithms (DGAs) for callouts to unique, dynamically generated web addresses. Common DGA detection techniques fail to reliably detect DGA variants that combine random dictionary words to create domain names that closely mirror legitimate domains. To combat this, we created a novel hybrid neural network, Bilbo the “bagging” model, that analyses domains and scores the likelihood they are generated by such algorithms and therefore are potentially malicious. Bilbo is the frst parallel usage of a convolutional neural network (CNN) and a long short-term memory (LSTM) network for DGA detection. Our unique F architecture is found to be the most consistent in performance in terms of AUC, 1 score, and accuracy when generalising across diferent dictionary DGA classifcation tasks compared to current state-of-the-art deep learning architectures. We validate using reverse-engineered dictionary DGA domains and detail our real-time implementation strategy for scoring real-world network logs within a large enterprise. In 4 h of actual network trafc, the model discovered at least fve potential command-and-control networks that commercial vendor tools did not fag. Keywords Domain generation algorithm · Deep learning · Malware · Botnets · Network security · Neural networks Introduction device. Some malware reaches out to a command and con- trol (C&C) centre hosted behind domains generated by an Malware continues to pose a serious threat to individuals algorithm (DGA domains) after it infltrates the target sys- and corporations alike [1]. Typical attack methods such as tem to receive further instructions. Identifcation of such viruses, phishing emails, and worms attempt to retrieve pri- domains in network trafc allows for the detection of mal- vate user data, destroy systems, or start unwanted programs. ware-infected machines. The majority of these attacks may be launched through the A single active DGA has been seen generating up to a network [2], posing a major threat to any Internet-facing few hundred domains per day [1]. At scale within a com- pany, this is infeasible for a human analyst to triage amidst This work was done while working at Capital One in 2017–18 and the thousands of benign domains occurring simultaneously. is based on public talks we gave in 2018. Automated detection systems are developing but the sight- ings of DGAs in worms, botnets, and other malicious set- * Kate Highnam tings is growing [3]. [email protected] In addition, malware that employs DGAs intentionally Domenic Puzio obfuscates its network communication by utilising ran- [email protected] dom seeds when generating their domains [1–5]. Most Song Luo known DGAs combine randomly-selected characters like [email protected] Nicholas R. Jennings [email protected] 1 Imperial College London, London, UK 2 Kensho Technologies, McLean, VA, USA 3 Tencent, Shenzhen, China SN Computer Science Vol.:(0123456789) 110 Page 2 of 17 SN Computer Science (2021) 2:110 Table 1 Examples of domains from our training data, comprised of testing sets but their performance can sufer when attempt- domains from the Alexa Top 1 Million list and domains generated by ing to generalise to new DGA families or new versions of dictionary-based DGA families (discovered through reverse engineer- ing) from DGArchive previously seen families. Against this background, we present a novel deep learning Legitimate Malicious model for dictionary DGA detection. This advances the state microsoft lookhurt of the art in the following ways. First, we present the frst linkedin threetold usage of parallel CNN and LSTM hybrid for DGA detec- paypal threewear tion, specifcally applied to dictionary DGA detection. The steamcommunity pielivingbytes model is trained on standard large-scale datasets of reverse- dailymotion awardsbookcasio engineered dictionary DGA domains. It achieves the most stackoverfow blanketcontent consistent success at dictionary DGA classifcation amongst facebook degreeblindagent state-of-the-art deep learning architectures for classifcation, soundcloud mistakelivegarage generalisability, and time-based resiliency. Second, we detail our insights into dictionary DGA domains’ inter-relation- ships and their efect on generalisability of models as an “myypqmvzkgnrf[.]com”, “otopshphtnhml[.]net”, and outcome. Third, we validate our model on live network traf- “uqhucsontf[.]com”1. fc in a large fnancial institution. In 4 h of logs, it discovered However, DGAs that combine random words from a dic- fve potential C&C networks that commercial vendor tools tionary like “milkdustbadliterally[.]com”, “couragenearest[.] did not fag. Finally, we detail our scalable implementation net”, and “boredlaptopattorney[.]ru” [6] are meaningfully strategy within the security context of a corporation for real- harder for humans to detect (see Table 1 for comparison). time analysis. In this paper, we will refer to this type of DGA as a diction- ary DGA and focus on those using dictionaries composed of English words. Background Common defences against malicious DGA domains include blacklists [7, 8], random forest classifers [9–11], An ever-growing number of malware rely on communication and clustering techniques [12, 13]. When the lists are well with C&C channels to receive instructions and system-spe- maintained and the features are chosen carefully, these meth- cifc code [1]. The destination (domain or IP address) of this ods have acceptable efcacy. However, both blacklists and channel can be hard-coded in the malware itself, making its these models possess serious limitations: relying on hand- location discoverable via reverse engineering or straightfor- picked features which are time-consuming to develop, lack- ward log aggregation techniques. Once known, this domain ing the ability to generalise with the few manual features or IP address can be blacklisted, rendering the malware inert. implemented, and requiring continuous expert maintenance. To avoid this single point of failure, malware authors employ More comprehensive tactics are necessary to detect inces- domain fuxing, in which the destination of the C&C com- sant new DGAs stemming from network-based malware. munication changes systematically as the attacker registers Recent innovations using deep learning have state-of-the- new domains to the C&C hub. art accuracy on DGA detection. Such models are highly fex- The key to malware domain fuxing is the use of unique ible with the proven success in complex language problems. and likely unregistered domains that are known to the They do not require hand-crafted features that are time- attacker but can blend in to regular trafc. To accomplish intensive to make and easy to evade. Woodbridge et al. [11] this, malware families employ domain generation algorithms were the frst to present a long short-term memory (LSTM) (DGAs) to create pseudo-random domains for use in com- network for DGA classifcation. Other architectures were munication. These domains are used for short periods of later applied, such as further variations on an LSTM [10, time and then phased out for newly-generated domains; this 14–17], a convolutional neural network (CNN) [18, 19], quick turnover means that manual techniques are not efec- and a hybrid CNN-LSTM model [20]. Although success- tive. Additionally, reverse engineering these algorithms may ful for random-character DGA domains, these classifers be slow or impossible if the malware is encrypted. For the have largely been inefective in identifying dictionary DGA vast majority of malware samples, trafc related to malicious domains. These models also perform well on their various activity is present in networks weeks or months before the malware is analysed and blacklisted [7]. To prevent DGA-based malware from exfltrating, disa- 1 bling, or tampering with assets, institutions must detect For the rest of this paper, all domain URLs will be referred to with [.] to prevent automatically assigning these domains as real URLs one malicious trafc as soon as possible. Throughout this paper, might click. we will discuss our solution while keeping in mind that it SN Computer Science SN Computer Science (2021) 2:110 Page 3 of 17 110 must be practical, operating in real-time, enriching contex- Much of prior DGA research has involved making tual data within in true threat environments. lookups into historical or related domain name server (DNS) records. Such methods often rely on signals attained from Non-Existent Domain (NXDomain) responses when Domain Generation Algorithms (DGAs) unregistered domains are queried. Since DGAs often gener- ate hundreds of domains per day and at most only a few of DGA usage spans a variety of cases, from benign resource those domains are actually registered by the attacker, large generation to phishing campaigns and the management of numbers of these requests result in NXDomains. Many botnets, groups of machines that have been infected by mal- NXDomain responses from the same computer are unlikely ware, such as Kraken [21], Confcker [22, 23], Murofet [24], to result from expected user behaviour, and thus this pattern and others [25]. The goal of all DGAs is to generate domains of DNS trafc can be associated with DGA activity [12, that do not already exist and, for malicious cases, will not be 25, 30]. fagged by vendor security tools or analysts. To accomplish However, such queries within high-volume DNS log data this, DGA authors typically use either character-based or can be prohibitively slow and unsuitable for real-time deci- dictionary-based pseudo-random assembly process to form sion-making needed to reduce the risk of compromise. It is domains. for this reason that our model considers limited data, only Each method has benefts and downfalls.
Load more

Recommended publications
  • Controller to Processor Model Clauses
    Controller To Processor Model Clauses burkaNowadays jumblingly methodical, and perv Wheeler so door-to-door! penalise silhouette Daryle breakwater and troupe imprudently. aircraftman. Guns Tamas sometimes biking his The parties to be a more complex processing of personal data subjects have the data breach any person acting as processor to The processor processes personal data on behalf of the controller and according to its instructions The SCCs specify the obligations of form the exporter and. Standard contractual clauses for the porcelain of TietoEVRY. The new draft sccs in writing that. Controlled via internet connection with respect your online. Appendix 1 to the Standard contractual clausesset IIcontroller to processor Model The following Information Law precedent provides comprehensive and. Privacy shield act data transfers under the gdpr. Supplier must be deemed by this article. From processors in the EU to a sub-processor in summary third award from controllers located in a old country sale to the GDPR to processors. And view Privacy ShieldController-Processor Clauses side-by-side comparison. We can personalize individual would no true onesizefitsall solution for processor? Standard clauses adopted by city Commission. On February 5th the European Commission decided to dream the standard contractual clauses for controller to processor transfers of. Samsara may change Customer Personal Data lake its Subprocessor for the. Update to Standard Contractual Clauses SCCs August 2020. These new zealand and are subject can be ensured by all applicable when left unchanged. Regulation authority requests or territory, including a decision which will no interaction with an acknowledgment of such assistance in most relevant healthcare meet its account management.
    [Show full text]
  • An Analysis of Domain Classification Services
    Mis-shapes, Mistakes, Misfits: An Analysis of Domain Classification Services Pelayo Vallina Victor Le Pochat Álvaro Feal IMDEA Networks Institute / imec-DistriNet, KU Leuven IMDEA Networks Institute / Universidad Carlos III de Madrid Universidad Carlos III de Madrid Marius Paraschiv Julien Gamba Tim Burke IMDEA Networks Institute IMDEA Networks Institute / imec-DistriNet, KU Leuven Universidad Carlos III de Madrid Oliver Hohlfeld Juan Tapiador Narseo Vallina-Rodriguez Brandenburg University of Universidad Carlos III de Madrid IMDEA Networks Institute/ICSI Technology ABSTRACT ACM Reference Format: Domain classification services have applications in multiple areas, Pelayo Vallina, Victor Le Pochat, Álvaro Feal, Marius Paraschiv, Julien including cybersecurity, content blocking, and targeted advertising. Gamba, Tim Burke, Oliver Hohlfeld, Juan Tapiador, and Narseo Vallina- Rodriguez. 2020. Mis-shapes, Mistakes, Misfits: An Analysis of Domain Yet, these services are often a black box in terms of their method- Classification Services. In ACM Internet Measurement Conference (IMC ’20), ology to classifying domains, which makes it difficult to assess October 27ś29, 2020, Virtual Event, USA. ACM, New York, NY, USA, 21 pages. their strengths, aptness for specific applications, and limitations. In https://doi.org/10.1145/3419394.3423660 this work, we perform a large-scale analysis of 13 popular domain classification services on more than 4.4M hostnames. Our study empirically explores their methodologies, scalability limitations, 1 INTRODUCTION label constellations, and their suitability to academic research as The need to classify websites became apparent in the early days well as other practical applications such as content filtering. We of the Web. The first generation of domain classification services find that the coverage varies enormously across providers, ranging appeared in the late 1990s in the form of web directories.
    [Show full text]
  • Redefining Security Analytics with Chronicle
    Google Cloud Whitepaper: Redefining Security Analytics with Chronicle Redefining Security Analytics with Chronicle DISCLAIMER: This whitepaper applies to Google Cloud products described at cloud.google.com. The content contained herein represents the status quo as of the time it was written. Google’s security policies and systems may change going forward, as we continually improve protection for our customers. Google Cloud Whitepaper: Redefining Security Analytics with Chronicle Table of contents The cyber security world has changed 3 SIEM reimagined: past to future 3 How to make sense of all the security data 4 New SIEM requirements 4 Scale 5 Speed 6 Simplicity 6 C o s t 7 Cloud and on-premise 7 Chronicle: A different approach to security analytics 7 a. Data ingestion 8 b. Data analysis 9 What is the threat? 9 What is it doing? 10 Does it matter? 12 How to respond? 15 c. Security and compliance 16 Summary of Chronicle capabilities and benefits 17 2 Google Cloud Whitepaper: Redefining Security Analytics with Chronicle Chronicle is a global security telemetry platform for detection, investigation and threat hunting within your enterprise network. Chronicle makes security analytics instant, easy, and cost-effective. The cyber security world has changed The threats and technology environments around us have changed radically. Security professionals lament that they must manage threats that originated in the 1980s, which means that old threats never leave; new threats simply pile on. It is clear that the environments an organization must secure and monitor have also dramatically expanded. Much of this change is additive - in addition to mainframes and Windows servers, there are cloud platforms, mobile, and SaaS.
    [Show full text]
  • Popielinski, M.A
    Noncorporeal Embodiment and Gendered Virtual Identity Dissertation Presented in Partial Fulfillment of the Requirements for the Degree Doctor of Philosophy in the Graduate School of The Ohio State University By Lea Marie Popielinski, M.A. Graduate Program in Women’s Studies The Ohio State University 2012 Dissertation Committee: Cathy A. Rakowski, Advisor Cynthia Selfe Mary Thomas Copyright by Lea Marie Popielinski 2012 Abstract This dissertation introduces the concept of noncorporeal embodiment as an analytical tool for understanding the experience of having a body in three-dimensional graphical virtual space, i.e., a representational avatar body. I propose that users of virtual worlds such as Second Life develop a sense of embodiment that is comparable but not identical to a sense of embodiment in the actual world. The dissertation explores three key areas—the development of a virtual identity, the practice of virtual sexuality, and the experience of virtual violence—to locate evidence that Second Life residents identify with their avatars in ways that reflect the concept as it is developed in the text. Methods include interviews with Second Life residents, a blog that presents questions for public response, and the use of resident-produced written materials (e.g., blogs, forum discussions, classifed ads), while theoretical perspectives are drawn from feminist theorists concerned with studies of the body in various respects. The dissertation concludes with a summation of the social patterns observed in the previous chapters and with a discussion of future directions for further research. ii Acknowledgments The completion of this dissertation was long in coming, and it would never have arrived without the guidance, support, and participation of a number of individuals who did not give up on me and would not let me give up on myself throughout the process.
    [Show full text]
  • Advancing Control and Visibility in the Cloud
    8/23/2020 New security tools for Google Cloud and G Suite | Google Cloud Blog Blog Menu ID ENTITY & SECURITY Advancing control and visibility in the cloud Sunil Potti VP/GM, Google Cloud November 20, 2019 At Google Cloud, we work tirelessly to give our customers increasing levels of control and visibility over their data. Today in London at Next UK, we’re announcing new capabilities for data encryption, network security, security analytics, and user protection designed to deliver on that promise. External Key Manager: Store and manage encryption keys outside of Google Cloud We give enterprises a broad range of encryption options so you can appropriately Finbda alann acret ircislek,. .c. ontrol, security, and operational complexity when protecting your cloud workloads. Google Cloud encrypts customer data at-rest by default and offers customers multiple Latest stories options to control and manage their encryption keys. Today, we’re pleased to announce the next level of control with our new External Key Manager. Coming soon to beta, Products External Key Manager works with Cloud KMS and lets you encrypt data in BigQuery and Compute Engine with encryption keys stored and managed in a third-party key Topics management system deployed outside Google’s infrastructure. External Key Manager allows you to maintain separation between your data at-rest and your encryption keys About while still leveraging the power of cloud for compute and analytics. RSS Feed https://cloud.google.com/blog/products/identity-security/new-security-tools-for-google-cloud-and-g-suite 1/6 8/23/2020 New security tools for Google Cloud and G Suite | Google Cloud Blog Blog Menu To make this new service easy to implement, we are working with five industry-leading key management vendors: Equinix, Fortanix, Ionic, Thales and Unbound.
    [Show full text]
  • Profiling Kernel-Level Events to Detect Ransomware
    Peeler: Profiling Kernel-Level Events to Detect Ransomware Muhammad Ejaz Ahmed, Hyoungshick Kim, Seyit Camtepe, and Surya Nepal Abstract—Ransomware is a growing threat that typically proposed to fight against ransomware as follows: machine operates by either encrypting a victim’s files or locking a victim’s learning models (e.g., [5], [6], [7], [8], [9]), use of decoy computer until the victim pays a ransom. However, it is still files (e.g., [10], [11], [7]), use of a key escrow mechanism challenging to detect such malware timely with existing tradi- tional malware detection techniques. In this paper, we present (e.g., [12]) and file I/O pattern profiling (e.g., [13], [14], [15], a novel ransomware detection system, called “Peeler” (Profiling [16], [17], [9], [18], [7], [19]). kErnEl -Level Events to detect Ransomware). Peeler deviates However, these techniques have at least one of the following from signatures for individual ransomware samples and relies limitations: 1) Localised visibility: existing approaches with on common and generic characteristics of ransomware depicted limited localized visibility would struggle to detect certain type at the kernel-level. Analyzing diverse ransomware families, we observed ransomware’s inherent behavioral characteristics such of malicious activities. For example, ransomware may first as stealth operations performed before the attack, file I/O request attempt to delete Windows backup files, disable anti-malware, patterns, process spawning, and correlations among kernel-level or real-time monitoring services on the victim’s machine to events. Based on those characteristics, we develop Peeler that remain undetected before actually starting to encrypt user files. continuously monitors a target system’s kernel events and detects Techniques relying on file I/O request patterns, cryptographic ransomware attacks on the system.
    [Show full text]
  • Redefining Security Analytics with Chronicle Backstory 2
    Chronicle Backstory whitepaper Redefining security analytics with Chronicle Backstory 2 Table of contents Understanding the salient needs and gaps in modern security analytics 3 Threat and complexity How to make sense of it all? New types of tools needed Scale Speed Simplicity Cost Coverage Chronicle Backstory: a different approach to security analytics 8 a. Data ingestion b. Data analysis What is the threat? What is it doing? Does it matter? How to respond? c. Security and compliance Summary of capabilities and benefits 3 Chronicle Backstory is a global security telemetry platform for investigation, hunting and detection of threats within your enterprise network. Backstory makes security analytics instant, easy, and cost-effective. Understanding the salient needs and gaps in modern security analytics Threats and complexity Today’s security professionals face not only an ever-expanding list of threats, old and new, but also an excruciating choice of security approaches and tools. Nearly 2000 security vendors are trying to sell to large enterprises and small businesses. Most organizations have already invested heavily in cybersecurity solutions. From firewalls to proxies and endpoint protection to DLP, the average firm has more than 40 types of security technologies in place, each generating telemetry that grows every year. With employees, contractors, partners, and customers all accessing online business processes that were once hidden in a back office, corporate network traffic has also increased significantly. There is more noise than ever before, hiding more attacks than ever before -- with greater impacts than ever before. 4 How to make sense of it all? Security analytics promises to help analysts make sense of this data, to find useful signals in the noise before it’s too late.
    [Show full text]
  • Get Smarter, Be Safer Virustotal Enterprise Provides the Information Your Security Team Needs to Protect Your Network from Threats
    TECHNICAL DATA SHEET Get Smarter, Be Safer VirusTotal Enterprise provides the information your security team needs to protect your network from threats VirusTotal Enterprise enables you to research and hunt for malware, to investigate security incidents, to automate analysis, and to keep your investigations private and secure. STATIC THREAT INDICATORS Gather signals to trace your threat. VirusTotal tools extract suspicious signals such as OLE VBA code streams in Office document macros, invalid cross reference tables in PDFs, packer details in Windows Executables, intrusion detection system alerts triggered in PCAPs, Exif metadata, and authenticode signatures. BEHAVIOR AND RELATIONSHIP VISUALIZATION Understand the details of how malware files act and communicate. VirusTotal Graph visualizes relationships across malware files, domains, and IP addresses. With Private Graph, you can link enterprise assets, users, and other custom information to public information within a Graph. IN-THE-WILD INFORMATION Gain context on threat location and techniques used to propagate and disseminate malware. VirusTotal runs backend processes for sandboxing, inter-file relationships, extracting attachments from emails, relating URLs to files, and characterizing files coming from honeypots. FILE RELATIONSHIPS AND PATTERNS Hunt for new malware threats related to incoming files. Run YARA rules continuously for pattern matching on files and actors and use VirusTotal backend processes to build inter- file relationships, extract attachments from emails and build
    [Show full text]
  • Enabling Secure Third-Party Security Analytics Using Serverless Computing
    Session 6: Security in Emerging System and Networks SACMAT ’21, June 16–18, 2021, Virtual Event, Spain SCIFFS: Enabling Secure Third-Party Security Analytics using Serverless Computing Isaac Polinsky Pubali Datta North Carolina State University University of Illinois at Urbana-Champaign Raleigh, NC, USA Champaign, IL, USA [email protected] [email protected] Adam Bates William Enck University of Illinois at Urbana-Champaign North Carolina State University Champaign, IL, USA Raleigh, NC, USA [email protected] [email protected] Abstract Keywords Third-party security analytics allow companies to outsource threat Serverless Computing; Security Analytics; Decentralized Informa- monitoring tasks to teams of experts and avoid the costs of in- tion Flow Control house security operations centers. By analyzing telemetry data ACM Reference Format: from many clients these services are able to ofer enhanced insights, Isaac Polinsky, Pubali Datta, Adam Bates, and William Enck. 2021. SCIFFS: identifying global trends and spotting threats before they reach Enabling Secure Third-Party Security Analytics using Serverless Computing. most customers. Unfortunately, the aggregation that drives these In Proceedings of the 26th ACM Symposium on Access Control Models and insights simultaneously risks exposing sensitive client data if it is Technologies (SACMAT ’21), June 16–18, 2021, Virtual Event, Spain. ACM, not properly sanitized and tracked. New York, NY, USA, 12 pages. https://doi.org/10.1145/3450569.3463567 In this work, we present SCIFFS, an automated information fow monitoring framework for preventing sensitive data exposure in 1 Introduction third-party security analytics platforms. SCIFFS performs decen- A key component of maintaining a good security posture is contin- tralized information fow control over customer data in a serverless uously monitoring your environment for security-related events.
    [Show full text]
  • YARA-L: a New Detection Language for Modern Threats
    WHITEPAPER YARA-L: A New Detection Language for Modern Threats SUMMARY Most enterprises use a SIEM to analyze security data, to detect threats and investigate incidents. However, most leading SIEM products were created more than a decade ago, and were designed for a different world. Today, the threat landscape and IT environment looks quite different: Data generated in petabytes, not terabytes; a mature public cloud infrastructure; new technologies such as EDR that generate useful but massive amounts of telemetry; and threats such as fileless malware that are either ephemeral or silent and persistent. We believe a new approach is required, and Chronicle offers that with YARA-L for threat detection. It is powerful, easily understood, and designed for threat analysis, not data query. INTRODUCTION Today, security operations and detection/response is largely about visibility and data — security telemetry data. Telemetry data allows us to know what is happening in our ever-expanding environments and ultimately enables much-sought-after situational awareness. While many assume that this means security naturally derives from hav- ing large amounts of data, telemetry on its own doesn’t provide visibility. More important is that data can be used for detection, alert triage, response, threat hunting, and other tasks. In essence, this means it’s not just the quantity of telemetry, but also the quality — consistency, structure, fidelity — of data that creates a clear signal about the attacker’s present and past behaviors. In fact, if more data translates into more noise, it is of no help. If more data translates into the user needing to run more searches, it is again of no help.
    [Show full text]
  • 1.Optimiza-Moderniza Tu Ecommerce
    Tus primeros pasos en la nube Moderniza tu ecommerce Tus primeros pasos en la nube Etapa 2 - Optimiza Moderniza tu comercio electrónico La realidad en torno a la que construiste tu estrategia de comercio electrónico está cambiando a pasos acelerados. Conoce en esta guía cómo comenzar una etapa de transformación de tu negocio con las herramientas de Google Cloud para administrar la capacidad, controlar los costos y responder a las necesidades de los clientes. La nube puede ayudarte a acelerar la productividad y aumentar tus ventas. • Logra un aumento de los ingresos digitales y omnicanal • Transforma tu comercio para que se base en los datos y se centre en los clientes • Impulsa las mejoras operativas Moderniza tu plataforma de comercio electrónico con Google Cloud 1. Convierte tu tienda en una arquitectura en contenedores nativa de la nube que te permitirá dar un giro a la experiencia de los clientes en todos los canales. 2. Utiliza soluciones con funciones avanzadas de Inteligencia (como Product Search de Vision y Recommendations AI) para ofrecer a tus clientes experiencias dinámicas y personalizadas. 3. Integra sistemas y canales comerciales en nuestra plataforma de gestión de APIs (Apigee) para ofrecer una experiencia de compra más 4. Aprovecha nuestros componentes de front/datos, o suscríbete a soluciones comerciales desde nuestro Marketplace. 5. Impulsa tu proceso de modernización con nuestra oferta de migración de almacenes de datos. 6. Minimiza riesgos de seguridad o la pérdida de alguna venta con nuestra red de alta velocidad, tecnología y experiencia operativa. 1 Tus primeros pasos en la nube 7. Implementación sencilla y en poco tiempo: desde 5-7 días hasta 10 días.
    [Show full text]
  • Acquisitions of Startups by Digital Firms and Merger Policy
    –––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––– Philipps Universität Marburg Acquisitions of Startups by Digital Firms and Merger Policy Name: Marinell E. Falcón G. ABSTRACT The rise of the digital economy has brought significant challenges to competition authorities around the world. When it comes to merger control, the authorities have realized that there is an increasing trend in acquisitions of startups by digital firms such as Google, Amazon, Facebook, Apple, and Microsoft (GAFAM). The latest research and reports on this area suggest that the main problem with the acquisition of startups in digital markets is that due to the low-turnover characteristic of the acquired companies, the transactions are not detected by competition authorities for a pre-merger assessment. As a result, it is challenging to distinguish anti-competitive from pro- or neutral competitive acquisitions. The purpose of this research is to contribute to the discussion of the challenges of merger control in the digital economy by addressing the following question: what are the factors that can be considered in the assessment of startup acquisitions by digital firms to identify anti-competitive acquisitions better? Through a literature research and descriptive analysis of the acquisitions of startups undertaken by GAFAM within the last decade, the present research considers that a better assessment of startup acquisitions should take into consideration the characteristics of the digital economy, the incentives of the startups and firms, as well as trends and characteristics of past acquisitions. ACQUISITIONS OF STARTUPS BY DIGITAL FIRMS AND MERGER POLICY TABLE OF CONTENTS 1. Introduction ................................................................................................................... 1 2. Competition challenges in the digital economy .............................................................. 5 2.1 Distinctive characteristics of the digital economy and market concentration ........................
    [Show full text]