Today's sophisticated cybercriminals are increasingly bypassing traditional antimalware solutions and inserting advanced persistent threats deep within networks. These highly targeted attacks evade established signature-based detection by masking their malicious nature in many ways - compression, encryption, polymorphism, the list of techniques goes on. Some have even begun to evade virtual "sandbox" environments using VM detection, "time bombs" and more. Fighting today's attacks requires a comprehensive and integrated approach - more than antimalware. More than a virtual sandbox. More than a separate monitoring system. FortiSandbox offers a robust combination of proactive detection and mitigation, actionable threat insight and integrated and automated deployment.
Proactive detection and mitigation
Suspicious codes are subjected to multi-layer pre-filters prior to execution in the virtual OS for detailed behavioral analysis. The highly effective pre-filters include a screen by the AV engine, queries to cloud-based threat databases and OS-independent simulation with a code emulator, followed by execution in the full virtual runtime environment. Once a malicious code is detected, granular ratings along with key threat intelligence is available, a signature is dynamically created for distribution to integrated products.
Actionable insight
All classifications - malicious and high/medium/low risk - are presented within an intuitive dashboard. Full threat information from the virtual execution - including system activity, exploit efforts, web traffic, subsequent downloads, communication attempts and more - is available in rich logs and reports.
