Ixia’s ThreatARMOR Delivers Zero-Day Malware Immunity

Automatically Blocks Malware/Ransomware Mutations

Ixia (Nasdaq: XXIA), a leading provider of network testing, visibility, and security solutions, announced today that the company’s threat intelligence gateway – ThreatARMOR™ – now offers Zero-Day Malware Immunity™ (ZDMI), which helps detect and block mutated versions of malware that use layers of sophisticated obfuscation techniques to evade detection by intrusion detection systems and anti-virus engines.

Hackers continue to develop new methods for penetrating network defenses, stealing data, and obscuring their activities.  Researchers scramble to bring new products to market to counter these ever-evolving—or, mutated—threats.  However, while new defensive technologies are in development, attackers have free reign until an offsetting security solution is widely available, at which time hackers roll out the next iteration or mutation of an attack, and the cycle begins again.

Zero-Day Mutations

A recent example of a Zero Day Mutation, in which malware changed to escape detection by signature-based antivirus and intrusion detection systems, was a variant of ransomware called Locky.  Zero-Day Mutations often target users through emails containing a document with macros. When the user opens it, the macro connects to the attacker’s remote server to download the ransomware.  Neither anti-virus nor sandboxes will detect Zero-Day Mutations until anti-virus vendors have analyzed it, which enabled Locky infections to hit 100,000 per day this year.

Ixia’s Threat Intelligence

Ixia takes a comprehensive approach to strengthening applications with security solutions that are kept up to date with a feed from the company’s Application Threat Intelligence (ATI) Research Center, which is continuously updated.  The ATI Research Center performs both manual and automated analysis of malware and techniques used by hackers to compromise networks, 24×7, 365 days a year.

“Ixia’s ATI Research Center captures and analyzes thousands of new malware samples, including mutations, daily,” stated Steve McGregory, Senior Director of Application and Threat Intelligence at Ixia.  “We pay particular attention to their networking activity – what domains they search for, what sites they connect to for downloading new instructions or executables, and where they send exfiltrated data.  We cross-reference all of those, and plug them into our machine learning and big data analytics engine to help ensure that our customers’ networks are protected.”

Zero-Day Malware Immunity with ThreatARMOR

ThreatARMOR leverages the Ixia ATI feed to protect customers from malicious sites and reduces security alerts by using the attack’s IP address to block it.  This means that even if a user accidentally opens a malicious document, the ransomware download attempt is blocked, nullifying the attack before other protections are even aware of the new threat.

ThreatARMOR delivers Zero Day Malware Immunity because it is not a signature-based solution. It blocks attacks based on an expansive “Rap Sheet” cloud database which contains up-to-date information about the proliferation of malicious IPs currently in use at a scale much larger than a next-gen firewall can support. ThreatARMOR’s ZDMI protects networks from Zero Day Mutations that bypass signature-based systems and wreak havoc on enterprise networks. Only sites with extensive proof of malicious activity are blocked, and clear on-screen evidence is provided by ThreatARMOR’s Rap Sheet.