SonicWall Real-Time Deep Memory Inspection (RTDMI™) technology enables SonicWall Capture Advanced Threat Protection (ATP) to catch more malware faster than behaviour based sandboxing methods, with a lower false positive rate. Throughout this article we will look deeper into this technology and what this all means from a security stand point. <\/p>\n\n\n\n
Network sandbox engines execute files, log the resulting activity, and then, after execution, look for an attempt to correlate malicious behaviour. The correlation and scoring of these activities and behaviours are prone to both false positives and negatives. They are also prone to cause delays, unsatisfactory end user experience and subsequent IT ticket requests.<\/p>\n\n\n\n
To allow malicious behaviour to remain hidden, modern malware writers implement advanced techniques, including custom encryption, obfuscation and packing, as well as acting benign within sandbox environments. These techniques often hide the most sophisticated weaponry, which is only exposed when run dynamically. In most cases, these are impossible to analyse in real-time using static detection techniques.<\/p>\n\n\n\n
Recently, SonicWall announced a new engine for Capture ATP called Real-Time Deep Memory Inspection (RTDMI) to improve the technilogy’s security effectiveness. Invented and developed by SonicWall’s capture Labs threat researchers, patent-pending RTDMI engine already had been running in the background of Capture ATP service for months beforehand, dynamically self-learning and self-enhancing.<\/p>\n\n\n\n
SonicWall RTDMI technology detects and blocks malware that does not exhibit any malicious behaviour or that hides it’s weaponry via encryption. <\/p>\n\n\n\n
To discover packed malware code that has been compressed to avoid detection, the RTDMI engine allows the malware to reveal itself by unpacking its compressed code in memory in a secure sandbox environment. It sees what code sequences are found within and compares it to what it has already seen. Identifying malicious code in memory is more precise than trying to differentiate between malware system behaviour, which is an approach used by some other analysis techniques.<\/p>\n\n\n\n
Besides being highly accurate, RTDMI also improves sample analysis time, Since it can detect malicious code or data in memory in real-time during execution, no malicious system