ESET Deep Behavioral Inspection enables deeper monitoring of unknown & suspicious processes

BRATISLAVA February 25, 2020 - Today, ESET released a white paper focusing on ESET Deep Behavioral Inspection (DBI) – the latest enhancement of the system specifically designed to perform advanced behavioral analysis and detection known as ESET Host-based Intrusion Prevention System (HIPS).

“Cybercriminals will go to great lengths to achieve their ultimate goal – stealing information, computing resources or money. Apart from social engineering techniques, they employ technical tricks such as obfuscation, encryption, and process injection, designed to help their code avoid detection by built-in as well as third-party security solutions,” explains ESET Security Awareness Specialist Ondrej Kubovič. “ESET DBI, together with other HIPS modules, represents an important protective layer that can detect and report these tricks and thus block malicious activity on the targeted system,” he adds.

Deep Behavioral Inspection, as one of the latest technological additions to the ESET HIPS framework, can be found in the latest edition of ESET products for home users. DBI includes new detection heuristics and enables an even deeper user-mode monitoring of unknown, suspicious processes. This is accomplished via hooks created by DBI within unknown, potentially harmful processes and monitoring of their activity and requests to the operating system. If malicious behavior is detected, DBI mitigates the activity and informs the user. If the process is suspicious, but does not show clear signs of malicious behavior, HIPS can also use the data gathered by DBI to run further analysis via its other modules.

ESET Host-based Intrusion Prevention System is a detection technology specifically created to monitor and scan behavioral events from running processes, files and registry keys, looking for suspicious activity. It focuses on a variety of malicious behaviors used either to wreak havoc on a victim’s device or to avoid detection by security solutions. The list of HIPS modules includes:

• Advanced Memory Scanner (AMS)
• Exploit Blocker (EB)
• Ransomware Shield (RS)
• Deep Behavioral Inspection (DBI)

Schematic indication of how DBI fits into the existing HIPS process monitoring layer