4 ms·
That's a common mistake of people that do not understand how AV's work and how virustotal work. From their own FAQ: At VirusTotal we are tired of repeating tha
by rmdoss 11y ago
That's a common mistake of people that do not understand how AV's work and how virustotal work. From their own FAQ:
At VirusTotal we are tired of repeating that the service was not designed as a tool to perform antivirus comparative analyses, but as a tool that checks suspicious samples with several antivirus solutions and helps antivirus labs by forwarding them the malware they fail to detect. Those who use VirusTotal to perform antivirus comparative analyses should know that they are making many implicit errors in their methodology, the most obvious being:
-VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc.
-In VirusTotal desktop-oriented solutions coexist with perimeter-oriented solutions; heuristics in this latter group may be more aggressive and paranoid, since the impact of false positives is less visible in the perimeter. It is simply not fair to compare both groups.
-Some of the solutions included in VirusTotal are parametrized (in coherence with the developer company's desire) with a different heuristic/agressiveness level than the official end-user default configuration.
thanks,
- JoachimSchipper 11y agoI do not understand how this is a response to the article, which doesn't make a comparison so much as claim that all AV suck.
- Natsu 11y agoIt seems to say that just because something passes virustotal with 0/56 doesn't necessarily mean it would pass every AV in a real attack.
- JoachimSchipper 11y agoDoes the comment actually say that, though? It would make sense if the comment said that, but e.g. > perform antivirus comparative analyses is not what is happening here.
- wmt 11y agoIf you just read the reasons why you shouldn't use it for comparisons, you should also understand why it's pointless to use VT for testing if you bypass AV or not. To quote: -VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc. -In VirusTotal desktop-oriented solutions coexist with perimeter-oriented solutions; heuristics in this latter group may be more aggressive and paranoid, since the impact of false positives is less visible in the perimeter. It is simply not fair to compare both groups. -Some of the solutions included in VirusTotal are parametrized (in coherence with the developer company's desire) with a different heuristic/agressiveness level than the official end-user default configuration.
- grub5000 11y ago> -VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc. It says right in the parent comment that the VT results may not actually reflect how the product performs in the real world.