If a security product identifies the original threat as known and creates a protection for it based on only one variation, any slight change to the code will turn that threat into an unknown. Like a virus, the malware continuously and automatically morphs and changes rapidly. This results in polymorphic malware or a polymorphic URL. Attackers take an existing threat and make slight modifications to the code, either manually or automatically, as the threat actively transitions in the network.

This method is somewhat more expensive than recycling threats. In the event that a security product doesn’t have a particular threat identified and stored, access to the larger knowledge base of threat intelligence could help determine if something is malicious and enable the security product to block it. To protect against these “unknown” recycled threats, it is critical to have access to a threat intelligence memory keeper, often placed in an elastic cloud infrastructure capable of scaling to address the volume of threat data. If an older threat, not tracked by the security product, attempts to enter the network, it could bypass the security product because it is not categorized as something seen before. All security products have limited memory, and security teams choose the most up-to-date threats to protect against, hoping they will block the majority of incoming attacks. What makes these recycled threats “unknown” lies within the limited memory of security products.

Recycled threats are considered to be the most cost-effective attack method, which is why attackers often recycle existing threats using previously proven techniques. How do they do it, and what can we do to prevent both known and unknown threats? To get past security products that successfully block known threats, attackers are forced to create something that has never been seen before, increasing the cost to execute an attack. The moment they see something that is known to be malicious, they block it. Most traditional security products are built to act based on known threats.

Define unknown