ISS adds protection based on behavior

Internet Security Systems has added a behavior-based malware-detection engine to its gateway intrusion-prevention system called the Proventia Network Integrated Security Appliance.

The Proventia appliance, formerly called the Proventia M line, already used signature-based anti-virus detection from Sophos to detect and block known viruses, says Leslie Horacek, ISS product marketing manager. But in an effort to block worm and virus outbreaks in the minutes before they are identified and given a specific signature, ISS is including a behavior-based blocking method to stop attacks based on code activity.

"It virtualizes the environment to trick the code to perform," Horacek says. "The technology watches to see if Outlook is being opened, for instance, or other behavior. Malware writers are not very creative, and they keep rewriting old pieces of code, so we can recognize a lot of it."

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

Internet Security Systems has added a behavior-based malware-detection engine to its gateway intrusion-prevention system called the Proventia Network Integrated Security Appliance.

The Proventia appliance, formerly called the Proventia M line, already used signature-based anti-virus detection from Sophos to detect and block known viruses, says Leslie Horacek, ISS product marketing manager. But in an effort to block worm and virus outbreaks in the minutes before they are identified and given a specific signature, ISS is including a behavior-based blocking method to stop attacks based on code activity.

"It virtualizes the environment to trick the code to perform," Horacek says. "The technology watches to see if Outlook is being opened, for instance, or other behavior. Malware writers are not very creative, and they keep rewriting old pieces of code, so we can recognize a lot of it."

Proventia provides options for receiving alerts or blocking perceived attacks. ISS says its internal testing has shown the appliance's behavior-based detection to be effective in automatically blocking 97% of the viruses that appeared this year. ISS says this is the same behavior blocking used in its client-security IPS product, Proventia Desktop.

A variety of behavior-based blocking products has been introduced over the past few years, including those from TippingPoint (acquired by 3Com), Sana Security, Determina, Bit9, WholeSecurity (acquired by Symantec) and Okena (acquired by Cisco).

The Proventia Network Integrated Security Appliance ranges in cost from $1,546 to $15,000.

Read more about security in Network World's Security section.