Sangfor Anti-Ransomware

Sangfor Engine Zero is a new approach to malware identification and blocking. It uses a multi-stage AI analysis engine with a 99.65% detection rate. Engine Zero is built into Sangfor NGAF - The Next Generation Firewall (NGFW) with Endpoint Security to identify malicious files at both the network level and endpoints. Anything that the on-premise capabilities cannot analyze is automatically sent to the cloud-based Neural-X sandbox.

Next generation anti-virus (NGAV) and anti-malware cannot identify direct malware command & control (C&C) communications. Firewalls can track communications to potential C&C servers, but they cannot verify if the communications are valid or malicious. Sangfor NGAF with Endpoint Secure not only validates malicious C&C communications but can query the endpoints to conduct a self-scan to search for infections, making it an effective anti-ransomware tool. If an infection is found, NGAF will terminate all communications outbound to C&C servers.

Endpoint Secure is a potent ransomware prevention solution as it installs advanced ransomware honeypot technology to quickly identify and kill file encryption processes before major damage is done. The ransomware honeypot installs bait files in the directories most likely to be encrypted first. Once a bait file is touched by an encryption process, Endpoint Secure can immediately kill the encryption process and identify the (normally hidden) controlling file. A hash signature is created for the controlling file and is sent to NGAF to query all other endpoints for the malware file. If found, the administrator can delete all instances of the file across the network with a single click.

Without an anti-ransomware solution, malware will spread to other vulnerable systems quickly, sometimes within only a few minutes. NGAF with Endpoint Secure can quickly isolate infected systems from the network to prevent this from happening. In some cases, the infected system may need to be operational for business requirements and cannot be isolated. Sangfor’s NGAF can identify unusual or unauthorized connections passing between endpoints across network segments. Those connections can be terminated to prevent the spread of malware across the network segments. And Sangfor NGAF is the only firewall that can graphically display allowed, suspicious, and malicious connections in real-time, enhancing its stature as a leading cyber security solution in the fight against malware and ransomware.