Advanced Detection and Prevention

Today’s attacks are designed to bypass your organization’s defenses, regardless of your industry or size. In fact, while 68% of observed malware appears only at one organization, 80% of observed malware appears once, period. Signature-based defenses cannot protect against single-use malware. Even more importantly, in many cases, attackers eschew malware for social engineering and other tactics.

Failure of standard detection methods

Conventional detection methods fail because they are incomplete:

  • Indicators are ephemeral. They can only be used to provide information about a specific, retrospective point in time data point. They are a piece of the puzzle, but cannot tell the entire story. You need more evidence to build the context necessary to anticipate future attacks.
  • Integrated perimeter controls, which include firewalls and sandboxes, often execute traffic objects sequentially, one at a time, in siloed environments and completely miss attacks that use multiple steps or non-digital steps.
  • Security analytics can identify anomalies and activities that have previously been unseen. However, what informs these algorithms? Absent of knowledge of the attacker’s behavior, attacks can easily evade these defensive measures.
  • Threat intelligence provides insights into the attacker’s tactics and techniques and may even correlate ongoing activity to an attacker. However, security programs can’t operationalize that knowledge into your detection architecture.

Video

Non-Malware Attacks and How to Detect Them

TESTIMONIAL

“The best product to effectively defend against zero-day malware and targeted attacks is FireEye.”

- Kunio Shimizu, Spokesperson and Certified Information Systems Auditor (CISA), Amuse, Inc.

Video

Always-on detection

FireEye detection takes a different approach

A well-designed security architecture must detect even the most sophisticated attacks while ignoring the distractions of false alerts. Proven FireEye detection blends detection analytics and machine learning, with threat intelligence into the patented MVX engine to:

  • Intuitively understand and codify the tools, techniques and procedures (TTPs) of attackers; evidence is broken down to an atomic level, and translated into products. Fusing detection research and analytics with visibility into the threat landscape delivers the insights to identify never before seen techniques and tools. Organizations are no longer trying to manually perform weak signal analysis to find the attack buried in the noise.
  • Use continually tuned and codified intelligence to reverse engineer attacker TTPs, track malware to its source, and perform other advanced detection functions

The automated detection engine is updated at least every 60 minutes with knowledge engineering of insights captured from incident responders from the world’s most sophisticated attacks, deep research gleaned from inside attacker systems, and millions of sensors monitoring for evidence of even the most sophisticated attacks worldwide. Fusing these detection techniques and sources of insights gives you the ability to identify never-before-seen attack tactics and tools.

Related products and services

related-email-security

Email Security

Analyzes email attachments and successfully quarantines spearfishing emails to protect against advanced email attacks.

related-endpoint

Endpoint Security

Provides threat and exploit detection capabilities to your network-connected devices.

related-faas

FireEye as a Service

Extends your security team with experts from FireEye who will monitor your network for threats around the clock.

Zero-day attacks

Read more about what a zero-day attack is, why they're difficult to detect and how FireEye helps detect and combat them.

Learn more

Zero-day attack white paper

A survey of zero-day attacks detected by FireEye and what they say about the traditional security model.

Get the white paper