APT defense

This help contains the following topics:

·     Introduction

¡     APT defense implementation

¡     Sandbox inspection mechanism

¡     Collaboration with the anti-virus feature

·     Configure APT defense

¡     Configure the sandbox

¡     Configure an APT defense profile

Introduction

An advanced persistent threat (APT) is a prolonged and targeted cyberattack. One of the most effective methods to defend against APT attacks is the sandbox technology. The sandbox technology creates an isolated threat inspection environment to analyze traffic that is delivered to it. If the traffic is malicious, the device will take the actions such as blocking.

APT defense implementation

As shown in Figure 1, when an external attacker initiates an APT attack towards the enterprise network, the APT defense is implemented as follows:

1.     If the attack traffic matches the APT defense policy on the device, the device extracts the file content from the traffic and reconstructs the file.

2.     The device sends the reconstructed file to the sandbox for threat analysis.

3.     The sandbox executes the file and analyzes the file behavior to determine if the file is malicious. After the inspection completes, the sandbox sends the file inspection result back to the device, and the device saves the result in its APT defense cache.

¡     If the traffic is malicious, the device will execute the block or alert actions for subsequent traffic based on the specified anti-virus policy.

¡     If the traffic is not malicious, the device permits it to pass.

Figure 1 APT defense implementation

Sandbox inspection mechanism

The sandbox is a virtual inspection system that simulates actual networks to run unknown files and record the file behaviors. The sandbox compares file behaviors with its exclusive behavior signature library. If a match is found, the sandbox determines that the file is malicious.

The sandbox builds its behavior signature library by analyzing signatures of various viruses, vulnerabilities, and threats, extracting the patterns of the malicious behaviors, and forming a set of rules.

Unlike the signature-based inspection (such as anti-virus inspection), the sandbox inspection identifies attacks based on behaviors and can identify unknown attacks.

Collaboration with the anti-virus feature

The sandbox only identifies whether the traffic is malicious or not, but it does not provides processing actions. If you want to take actions on the malicious traffic, the device needs collaborate with the anti-virus feature. With the anti-virus feature configured, the device identifies the application layer protocol of the malicious traffic, and then compares the traffic with the anti-virus policy. If a match is found, the device takes actions on the malicious traffic.

For more information about anti-virus profile, see antivirus online help.

Configure APT defense

Configure APT defense as shown in Figure 2.

Figure 2 APT defense configuration procedure

Configure the sandbox

Procedure

1.     Click the Objects tab.

2.     In the navigation pane, select APPSecurity > APT Defense > Sandbox.

3.     Configure the sandbox.

Table 1 Sandbox configuration items

4.     Click OK.

Configure an APT defense profile

Perform this task to configure an APT defense profile.

Procedure

1.     Click the Objects tab.

2.     In the navigation pane, select APPSecurity > APT Defense > Profiles.

The APT Defense Profiles page opens.

3.     Click Create.

The Create APT Defense Profile page opens.

4.     Create an APT defense profile.

Table 2 APT defense profile configuration items

5.     Click OK.

The APT defense profile is displayed on the APT Defense Profiles page.

6.     Use the APT defense profile in a security policy. For more information about security policies, see security policy online help.