Anti-Bot Software Blade

The Check Point Anti-Bot Software Blade detects bot-infected machines, prevents bot damages by blocking bot C&C communications, and integrates with other Software Blades to provide a comprehensive threat prevention solution on a single gateway.

A Bot is malicious software that invades your computer. Bots allow criminals to remotely control your computer to execute illegal activities such as stealing data, spreading spam, distributing malware and participate in Denial of Service (DOS) attacks without your knowledge. Bots play a key role in targeted attacks also known as Advanced Persistent Threats (APTs).

Benefits
Features
Model Specs

New Software Blade stops bot attacks and prevents bot damage

Prevent damage by blocking bot communication between infected hosts and a remote operator
Protect with high performance of up to 40 Gbps

Innovative Discovery of Bot-Infected Machines

Analyze network traffic through the gateway with a unique Multi-tier ThreatSpect™ engine to detect infected hosts
Combine information on remote operator hideouts, unique botnet communication patterns and attack behavior to identify thousands of different botnet families and many millions of outbreak types
Receive up-to-the-minute bot updates from Check Point’s ThreatCloud™ repository

Most Comprehensive Threat Prevention Solution

Integrate in a single gateway all critical threat prevention technologies – IPS, AV, Anti-SPAM, URL Filtering and Anti-Bot
Investigate infections with extensive forensics tools and easily assess damages
Quickly analyze risk through malware-threat reports and dashboards showing infection summaries and trends.

Complete Anti-Bot Solution

Complete Anti-Bot Solution - integrated into Check Point Software Blade architecture

Discover, stop and assess bot damages on a single gateway
Unified and centralized management using Check Point SmartEvent
Available on every gateway

Mulit-Tier ThreatSpect™ Bot Detection Engine

Multi-Tier ThreatSpect™ Bot Detection Engine - the Anti-Bot Software Blade discovers infections by correlating multiple detection methods

Reputation – evaluating IPs, URLs, and DNS addresses to determine whether outbound traffic is destined for known botnet Command and Control (C&C) sites.
Patterns - detecting unique botnet family communication patterns (over multiple protocols such as HTTP, DNS and SMTP)

Bot damages & actions by detecting attack types, such as Spam (leveraging outbound mail analysis) and Click fraud, as well as anomalies (irregular ports, protocols)

Inline Bot Prevention

Inline bot prevention – block bot communications from infected hosts

Support Inline and out-of-band deployment topologies
Block bot specific communication to C&C sites to neutralize bot damages and ensure work continuity

ThreatCloud™ Bot Information Updates

Bot Information updates – providing automatic updates, using the ThreatCloud™ infrastructure, to the Anti-Bot Software Blade of the latest IP/URL/DNS reputation data and botnet communication patterns

Eliminates administrator's need to constantly update policies or threat data bases

Forensics Analysis

Forensics - Providing administrators and security teams with the information they need to analyze security events, investigate infections and assess damages

Detailed infection information per malware type and/or infected users and machines
Threat Wiki – extensive infection information (malware type, description and any available details such as executables run, used protocols etc.)
Key bot actions – identify suspicious activities such as participating in DDoS attacks, self-distribution attempts, and participating in click fraud
Packet capture – view data sent using complete per-session packet capture with SSL inspection

Malware Reports and Dashboards

Malware reports and dashboards - infection summaries and trends to provide better visibility to organizational malware threats and risks

View infected hosts statistics, malware types and activities, trends/changes vs. previous week/month, amount of data sent or received and more

anti-bot-detection-overview

Summary of infected hosts

Set Granular Policies

Granular policy setting – detect and prevent suspicious actions per any user/machine

Hierarchical rule based engine providing administrators with complete flexibility

Separate policy installation – minimize organizational risks by only updating specific Anti-Bot Blade policy (e.g. no need to also update Firewall policy)

Software Blade Specifications

Supported Appliance Families

Check Point 2200, 4000, 12000, and 21400 Appliances
Check Point Power-1
Check Point IP Appliances
Check Point UTM-1
Check Point IAS

Supported Operating Systems

SecurePlatform
IPSO 6.2 Disk-based
IPSO 6.2 Flash-based
Windows

Anti-Bot Software Blade

Complete Anti-Bot Solution

Mulit-Tier ThreatSpect™ Bot Detection Engine

Inline Bot Prevention

ThreatCloud™ Bot Information Updates

Forensics Analysis

Malware Reports and Dashboards

Set Granular Policies

Software Blade Specifications

Free Consultation

Unbeatable Prices

Pro Services

24x7 Tech Support