Bitdefender SDKs for Endpoint Protection

Bitdefender’s Anti-malware SDK offers a set of multi-layered, industry-leading, protection technologies that can be integrated into your solution to provide added value and justify additional premium from existing customers that use legacy solutions. Anti-malware SDK can also be used to seize new opportunities, by leveraging market demand for protection suites. 

Bitdefender’s Anti-malware SDK can be easily implemented at the endpoint and it can also be complemented by a wide range of Bitdefender security technologies to harden security, protect against new threat vectors.

Features

• Tailored for endpoint integration
  It comes with a full set of additional components required for an endpoint protection solution.
• Cross-platform
  It supports multiple operating systems (Windows, Linux, MacOS) with the same API.
• Detection
  Extensive array of protection layers, including heuristic analysis, signature-based detection, emulation, generic detection, and signatures-leveraging machine learning models.
• Remediation
  It offers full remediation for prevalent threats.
• Seamless integration with Bitdefender Global Protective Network.
• Battle-tested
  Extensively used by Bitdefender Technology Partners and incorporated into Bitdefender’s premium set of products.

Bitdefender’s Advanced Threat Control (ATC) SDK employs a proactive and dynamic technology based on advanced heuristics methods to detect zero-day threats in real time. An on-execution protection layer, the SDK augments Bitdefender’s comprehensive pre-execution detection technologies, and enables organizations to add an extra layer of protection that drastically reduces the risk of new or evasive malware compromising a system. 

Operating on a zero-trust assumption, the ATC SDK permanently monitors active applications and processes for any signs of malicious behavior. It relies on actual behavior characteristics instead of signatures or binary or code fingerprints, which lets the SDK consistently detect new ransomware variants, other zero-day threats and file-less attacks.

Features

• High efficacy against ransomware, zero-day exploits and advanced persistent threats (APTs).Detects advanced attacks early and prevents breaches, reducing incident response costs and efforts.
• Awarded technology – Bitdefender had an average detection rate of 99.9% in 2020 Real-World Protection tests run by AV-Comparatives; and won the “Product of the Year” award for scoring “Advanced+” in all 7 tests conducted in 2020.
• Intelligent performance optimization for application and process monitoring ensures low system impact.
•  Designed to facilitate remediation and cleanup of detected malware.
• Acts as an additional or last layer of defense against known and unknown threats, complementing Bitdefender’s anti-malware scanning technologies and heuristics.

A powerful layer of protection against stealthy attacks, the Sandbox service analyses suspicious files in depth, detonates payloads in a contained virtual environment, analyses their behaviour, reports malicious intent and provides actionable insight. 

The Sandbox service acts as a “real target environment” for potentially malicious files, where everything is carefully crafted so threats act as they would in the wild, making it a powerful tool against targeted malware attacks and malware infiltration.

Features

• Provides advanced threat protection and zero-day exploit detection.
• Utilizes Bitdefender Global Protective Network intelligence to detect malware.
• Leverages purpose-built, advanced machine learning algorithms, aggressive behaviour analysis, anti-evasion techniques, and memory snapshot comparison to detect threats.
• Analyses a broad range of targets (emails, documents, application files and more).
• Delivers in-depth reporting on malware behaviour and enables early visibility into valuable indicators of compromise (IOC).
• Helps uncover malicious files including polymorphic and other threats designed for undetectable targeted attacks.
• It is extremely easy to integrate; no effort needed to install and set-up locally, as it is a web service.

Bitdefender’s Web Filtering SDK gives partners effective URL and webpage category-based filtering capabilities, allowing them to develop solutions that categorize URLs and websites in real time and further facilitates web access monitoring and control. This lets partners successfully address customers’ concerns about security, while increasing employee productivity and freeing up valuable IT resources and network bandwidth.

Features

• Broad coverage, including millions of relevant active URLs and websites, in multiple languages.
• 50+ domain categories, including high-risk ones (drugs, gambling, hacking, hate, illegal, porn etc.).
• High-accuracy detection ensured by heuristic filtering coupled with signatures and URL blacklisting.
• The combination of fast cloud URL lookups with a local database cache prevents any latency.
• Offers around-the-clock cloud-based updates of web categories; domains are added or updated instantly.
• Offers an easy-to-use cross-platform API that keeps the integration time to a minimum and is fit for a variety of use cases.

The Online Threats SDK detects malicious, phishing, and fraudulent websites before they can expose users to scam attacks. It uses advanced local and cloud filters to analyse URLs and web page content and return a quick verdict (clean, phishing, fraud etc.). 

The SDK combines superior detection powered by advanced heuristics with cloud-based updates provided by the Bitdefender Global Protective Network. which processes billions of website transactions daily. Using the GPN cloud ensures instant detection and/or updating of URLs and websites, even regarding those that are live very briefly, as well as fast reaction to new attacks such as phishing outbreaks.

Features

• The Online Threats SDK offers real-time protection from online cyber threats such as phishing and fraud attacks.
• The combination of cloud and local filters ensures high-speed scanning and accuracy, with a very small footprint.
• Advanced heuristic techniques ensure enhanced detection of phishing attempts and outbreaks.
• Malicious URLs are updated in real time using the Bitdefender Global Protective Network.
• Offers a simplified, easy-to-use cross-platform API that ensures a quick and easy integration process.
• Proven proprietary technologies, extensively used in the Bitdefender portfolio of products and SDKs.

The Endpoint Protection SDK addresses the needs of the most demanding enterprises by providing cross-platform security for physical and virtual endpoints, including multi-layer anti-malware protection, behavioral scanning, firewall, web security, device control and disk encryption etc. 

This is done simply by deploying a local agent that issues commands to the client security software and can be remotely controlled via JSON calls from the partner’s centralized management console.

Features

• File scanning
  On access and on demand, using Bitdefender’s award-winning antimalware engine.
• Behavioral scanning
  Proactive malware detection technology based on continuous application lifecycle behavioral monitoring; it also includes the anti-exploit technology, which is a behavioral base technology specialized in detecting ROP type of exploits.
• Email/web traffic security
  Anti-malware, anti-phishing, and anti-fraud scanning.
• Stateful endpoint-level firewall.
• Volume encryption
  Full disk encryption, preventing the loss of sensitive information
• User control
  Web control, categories-based filtering, application blacklist, data protection.
• Device control
  Prevents sensitive data leakage and malware infections via external devices.
• Application Control/Application whitelisting. 

The Anti-Ransomware SDK offers an additional layer of protection against the ever-evolving threat landscape of ransomware, now one of the biggest threats to both personal and business data.

Features

• Protects mission-critical content from zero-day ransomware. Controls the effect of an otherwise successful ransomware attack.

The Bitdefender URL Status service is a completely cloud-based solution that detects malicious, phishing, and fraudulent websites in the cloud and in real-time before they can expose a user to an attack or scam. 

URL information is updated in real-time, with new malicious URLs, with domains identified and processed by Bitdefender technologies, and additional intelligence gained from multiple sources.

Features

• Broad coverage, including millions of relevant, active URLs and websites, in multiple languages.
• 50+ domain categories, including high-risk ones (drugs, gambling, hacking, hate, illegal, porn etc.).
• High-accuracy detection backed by a variety of technologies and data-sources.
• Offers around-the-clock cloud-based updates; detection is updated instantly.

The Bitdefender Traffic Interceptor SDK allows the interception and scanning of HTTP, HTTPS, SMTP and POP3 traffic, as well as that of custom protocols.

Features

• Real-time traffic inspection of HTTP protocol.
• Real-time interception of emails delivered through SMTP and POP3 protocols with the ability to access and modify the email messages.
• Support for intercepting raw data, so you can implement your own protocol decoders.
• Provides optional integration with Bitdefender URL Reputation Service.

Bitdefender provides advanced technologies for protecting Android devices against known and emerging threats. The Anti-malware SDK identifies and blocks malware applications before they can be fully installed on mobile phones or tablets, enabling partners to protect users against malware, Trojans, phishing or other threats.

Features

• Detect and block malicious content on mobile devices running the Android platform.
• High speed with low footprint on resources.
• Offers around-the-clock cloud-based updates by leveraging Bitdefender Global Protective Network.
• Supports Android on ARM platforms.

The Bitdefender Web Security SDK provides real-time detection of malicious or fraudulent web content and URLs. It scans URLs through the Bitdefender Global Protection Network and returns their status (clean, fraudulent, phishing etc.). It also offers the ability to filter content based on more than 50+ web categories (search engine, social networks, gambling, pornography, drugs etc.).

Features

• Detects and blocks web-based threats on Android devices.
• Java-compatible interface: no compatibility or portability issues.
• Supports Android on ARM platforms.
• Compatible with Android default browser and other popular browsers.

The Bitdefender Web Security SDK for iOS-powered mobile devices detects malicious or fraudulent web content and URLs. It scans URLs via the Bitdefender cloud and returns their status (clean, fraudulent, phishing etc.).

Features

• Privacy
  The actual traffic never leaves the local device; only the domains extracted from DNS request are sent for analysis using encrypted communication
• App compatibility
  The technology is compatible with all applications and browsers.
• Simplicity & Performance
  Only DNS traffic is decoded, which means that the complexity of the SDK is lessened, reducing the attack surface.
• Protocol compatibility
  The SDKs works for all protocols, including HTTP, HTTPS, HTTP/2 and others.

Deployable as a virtual appliance and managed through a rich UI, the on-premise packaging of the Sandbox Analyzer environment provides an additional layer of security, focused primarily on threat hunting and forensics. Unlike a cloud service, the on-premise deployment allows for total control of the detonation environment used for malware analysis, enabling OEM partners to determine the specifics of the overall environment and corresponding software used to analyze files and apps. Currently supported on the VMWare ESXi environment, deploying the solution through a virtual appliance allows unlimited scalability given the limits of physical underlying hardware.

Features

• Deployed as single management VM on dedicated physical host.
• Uses VMFS version 5, tested on ESXi 6.5, 6.7.
• Orchestration and high-level management through on-premise instance of Gravity Zone Control Center.
• Requires the underlying physical host to offer at least 12cores/24 threads and 64GBs of RAM plus 1TB of usable SSD storage for minimal deployment (sandbox manager + 2 detonation slots).
• Supports Windows 7 & Windows 10 as base for golden imaging and detonation VMs (64 bit only)