McAfee Artemis Technology is a cloud based Malware Protection technology from McAfee. McAfee Artemis Technology offers real-time security using a combination of signature and behavior analysis with community threat intelligence.
The “Protection Gap” in Current Solutions
Current solutions that rely on signatures for protection against threats suffer from an inherent protection gap. There is a lag from when malware first appears (at time = 0) until most users are protected (at time = 4 in our graphic). During this period, a threat must be discovered and analyzed, and a signature must be developed and finally applied at the endpoint. This lag can vary between 24 and 72 hours, leaving the customer exposed to the threat during this time. Security vendors also offer behavioral techniques (such as host intrusion protection systems) at endpoints. However, these technologies work in “silos,” without any communication between each other. Because many of these threats are stealthy and blended attacks (using multiple channels such as email and web for infection and propagation), it is critical to correlate the intelligence that these protection methods gather with the threat data from the user community.
McAfee Artemis Technology
McAfee Artemis Technology is the first real-time threat protection that significantly reduces the exposure to known and emerging threats. Using community threat intelligence, McAfee Artemis Technology compresses the research life cycle to close the protection gap. This protection is available on McAfee endpoint security products at no additional cost, and it works anytime, anywhere—whenever a system is connected to the Internet—with no change to the user experience.
McAfee Artemis Technology provides a new, “always-on” delivery model for relevant, up-to-date research and response to close the protection gap. Using a combination of signature/behavior analysis and the application of community threat intelligence, its real-time “pull” model delivers protection to the system whenever it’s required. This is a supplemental mechanism to the already-present, signature-based detection. When the user receives a file that the scan agent deems suspicious (for example, an encrypted or packed file), and for which there is no signature in the local .DAT database, the agent, using Artemis Technology, sends a fingerprint of the file for instant lookup to the comprehensive database at McAfee Avert® Labs. If the fingerprint is identified as known malware, an appropriate response is sent back to the end user’s computer in milliseconds to block or quarantine the file.
Protection Gap Elimination
With McAfee Artemis Technology, the entire Avert Labs database of threat intelligence is available to the endpoint so that it is protected from the malware whenever it appears. Using Artemis Technology is like having an Avert Labs researcher at each desktop, looking at any suspicious file for which there is no local signature. Because the intelligence is derived from multiple sources, including the entire McAfee user community, the discovery and availability of protection from the malware is available sooner than before. This compression of the protection gap significantly reduces the exposure to threats.
Enterprises have the ability to manage their risk tolerance by selecting in McAfee ePolicy Orchestrator® (ePO™) the appropriate sensitivity level for suspicious file detection.
Zero-Touch, Zero-Cost, Seamless Enablement
McAfee Artemis Technology comes built into McAfee endpoint products at no additional cost. For enterprises, Artemis Technology can be enabled seamlessly through McAfee ePO without having to install any additional software on the endpoint—nor is there a need for any additional management component. A simple selection in a check box enables all the clients for this on-demand, real-time protection. There is no additional overhead or increase in operational costs for enterprises to benefit from this increased level of security.
Via McAfee
