Advanced Network Malware Detection

Traditional cyber-security defenses are myopic and asymmetric; the attackers collaborate globally while the security vendors struggle independently. MetaFlows SaaS technology disrupts this trend by leveraging the most diverse set of threat indicators available today and implicitly sharing incident report data between our customers.

For example, our Network Antivirus system not only uses more than fifty five (55+) antivirus solutions at once, but also uses a mix of proprietary, commercial and collaborative feeds to analyze the behavior of the content as it is executed/opened to determine whether it is well behaved.

Furthermore, when you deploy our technology, your enterprise becomes an integral part of our cloud-based correlation system. Each deployment becomes both a consumer of 300,000 threat indicators from the Internet community and a producer of threat data contained in the incident reports generated. By anonymously sharing threat intelligence from multiple enterprises we can extract dangerous communication patterns that are strong predictors of a potential compromise. This information is then fed back to each customer in the form of dynamic IPS block rules.

Even More

Traditional Network IDS software generates alerts by finding known threat patterns within a single TCP/UDP session. This usually results in a very high false positive rate. Important events are often missed due to the huge volume of false positive or low-priority network security events.

MetaFlows uses Multi-Session Correlation. Multi-session correlation is an evolution of dialog-based correlation first introduced by a revolutionary malware detection tool called BotHunter.

Multi-session correlation extends dialog based correlation by leveraging diverse threat intelligence that goes well beyond signature based IDS alerts. Simply put, it automatically connects the dots between (any) security alert involving a single internal host with multiple external hosts over time.