Sigfree SDK

The SigFree SDK allows you to develop applications capable of identifying and dealing with malware, even self-modifying malware, as soon as it’s launched – at DayZero.

SigFree is signature free, does not rely on string-matching and does not slow you down.

SigFree can detect suspect code even employing polymorphism, encryption, metamorphism, self-modifying, anti-disassembly, and anti-emulation.

DayZero and SigFree change the trade-off dilemma between effectiveness and cost which faces malware protection today. What had been too expensive to implement for true zero day protection in the past is made feasible today with SigFree.

The yellow triangle depicts the typical deployment methodology today. Most economical is to “allow the known good” and “block the known bad”. Allowing the “known good” is the most economical but the least reliable. To manage new unknown threats usually results in high system overhead, reduced throughput, and high false positives. Before DayZero and SigFree, use of the latter approach had been minimized in order to contain costs and retain system performance.

DayZero changes this equation with its SigFree technology and provides defense against unknown attacks with low system overhead, no noticeable reduction in throughput, and virtually zero false positives.

SigFree has the following general characteristics:
• SigFree is signature free -Identifies new and unknown threats
• Does not rely on string-matching
• Very resilient to attack code mutating
• Uses generic code-data separation criteria instead of limited rules
• No changes to legacy systems required
• SigFree does not slow you down
• SigFree is an economical deployment with extremely low maintenance cost
• SigFree is the first technique that can detect self-modifying code without any runtime analysis
• SigFree can handle polymorphism, encryption, metamorphism, self-modifying, anti-disassembly, anti-emulation

SigFree’s first recognizes that valid requests contain data and no executable code, nor, for example, branch functions or indirect jumps. SigFree will disassemble and distill code recognizing that,

• A “code segment” may start at any address of the payload
• A malicious payload may contain very little (compared to its size) code.
• A 1MB payload may contain only 30~40 bytes of malicious code
• A normal payload may contain a large number of random “instructions”
• A malicious payload may be obfuscated, or be disguised in other ways such as use of branch functions, indirect jumps, and code overlap.

SigFree technology allows disassembly and distillation and defeats encryption, self-modification, anti-disassembly and other obfuscation techniques – all with very little impact on system performance; i.e., with high effectiveness.

SigFree has been shown to achieve all of this with a zero false negative rate and false positive rates varying from zero to 0.0079%.