deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-14 14:27:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

behavioral blocking

Browse Source
This commit is contained in:
Denise Vangel-MSFT 2020-03-09 11:38:11 -07:00
parent abe0b6a4f9
commit c4f90bd7e7
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
windows/security/threat-protection/windows-defender-antivirus/images/pre-execution-and-post-execution-detection-engines.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 134 KiB

18
windows/security/threat-protection/windows-defender-antivirus/next-gen-behavior-blocking.md
View File

@ -22,9 +22,23 @@ ms.collection:
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
## section 1
## What is behavioral blocking?
Behavioral blocking and containment capabilities in Microsoft Defender ATP use machine learning to identify threats through behavioral patterns. When threats are detected, Windows Defender Antivirus works together with your Microsoft cloud protection. Suspicious artifacts and behaviors are monitored, processed, and sent to your cloud protection for real-time classification by machine learning. If artifacts or behaviors are determined to be malicious, these threats are blocked and contained almost instantly.
Behavioral blocking is a post-execution protection, as shown in the following diagram:
Behavioral blocking consists of the following components:
- Behavior-based machine learning
- Rapid-protection feedback loop
- [Shadow protection](shadow-protection.md)
- Client-side behavioral blocking
- Containment during automated investigation and remediation
Behavioral blocking and containment capabilities in Microsoft Defender ATP use machine learning to identify threats through behavioral patterns. When threats are detected, Windows Defender Antivirus works together with your cloud protection. Suspicious artifacts and behaviors are monitored, processed, and sent to your cloud protection.
## section 2