Devising a method of protection against zero-day attacks based on an analytical model of changing the state of the network sandbox

This paper reports a method of protection against zero-day attacks using SandBox technology based on the developed analytical model with probabilistic ranking information system states. The takes into consideration conditions priori uncertainty regarding parameters destructive flow system, accounting for typical procedures network SandBox. proposed states makes it possible to analyze and track all states, as well assess level security in these probability transitions them. Thus, is identify most dangerous ones activities that caused corresponding changes. fundamental difference between this standard approaches weight coefficients characterize not intensity random events but Direct implementation application involved multilevel "SandBoxes". from other popular anti-virus tools use mathematical threat assessment, which detect influences are considered threats by classical systems until moment harm system. combination separately files too large size, whether they enter through common gateway controlled "SandBox" external media end-users. has made improve corporate 15 %, number detected threats. explained inability software new if already listed database program, their activity trivial