Hypervisor-based 3rd Generation Threat Detection
•
0 likes•421 views
VMRay Analyzer is a hypervisor-based threat detection solution that provides best-in-class analysis of malware and targeted attacks. It utilizes full hypervisor integration to allow for high performance, scalable analysis that is resistant to detection and evasion techniques. VMRay's approach leverages the hypervisor to monitor all activity within virtual machines and detect advanced persistent threats and targeted attacks that other tools may miss.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Hypervisor-based 3rd Generation Threat Detection
Similar to Hypervisor-based 3rd Generation Threat Detection (20)
Recently uploaded
Recently uploaded (20)
Hypervisor-based 3rd Generation Threat Detection
- 1. VMRay Analyzer is: • Hypervisor-based high-performance threat detection • Best-in-class threat analysis • Defense against a rapidly evolving threat landscape • Detection and evasion resistant 3rd Generation Threat Detection
- 2. Where it’s used OEM Integration Embed VMRay into Security Appliances and Cloud Security Solutions Incident Response Enterprises and Organizations doing incident response against targeted attacks (CERT, CIRT, LEO) Threat Intelligence Security Solution Providers augmenting their threat intelligence Protection Analysis results become actionable intelligence for other security products (AV, NGFW, ..)
- 3. Hooking 2nd Generation Dynamic Analysis Evasive Malware, Targeted Attacks, APTs, Rootkits Evolution of Malware Analysis Emulation 1st Generation Dynamic Analysis 3rd Generation Dynamic Analysis Hypervisor Antivirus Signature Based Analysis Polymorphism, Encryption & Obfuscation Exponential Growth of Malware
- 4. Full Hypervisor Integration Detection & evasion resistant 3rd Generation Threat Detection Utilization of Virtualization Extensions High performance & scalability Innovative Monitoring Approach Leverages hypervisor - detects APTs & Targeted Attacks 1 2 3
- 5. VMRay Performance and Scalability Our hypervisor-based architecture delivers performance and scalability other approaches can’t match.
- 6. VMRay monitors, analyzes – and detects threats
- 7. • Fully customizable VM Images • Analyze your own enterprise environments • Analyse many threat types • Executables, Office/PDF documents, browser exploits, scripts, … • Kernel rootkit analysis 32/64 bit • Flexible, comprehensive API Key Features Enhanced threat protection for the enterprise Use scarce and skilled resources more effectively Faster incident response
- 8. • Deep Visibility & Inspection • Hypervisor monitoring of all malicious code • Unparalleled Performance and Scalability • Bare metal execution and less interrupts • Complete virtualization • Detection & Evasion-Proof • No single bit within VM modified • Monitoring done from the outside Summary Enhanced threat protection for the enterprise Use scarce and skilled resources more effectively Faster incident response
Editor's Notes
- For each potential threat submitted, VMRay can run analyses against multiple different environments corresponding to the comibination of OS, applications and localisation you are most concerned with. VMRay monitors each analysis from the hypervisor, so the threat executes exactly as it would in the wild, with no modification of the target machine During analysis, network communication is captured and reported. If user interaction is expected, for example to override a UAC warning, VMRay will automaticaly provide the expected user input. During all this, processes of interested are tracked and monitored. Upon completion of analysis, a Severity Score is provided showing the degree of maliciousness of the suspected threat. This score can be used to take action manually or automatically against the threat.