5 ms·
Traditionally they scan files, either in a batch job or on the fly, to see if the file matches a signature, basically a hash, of known viruses. This worked when
by quantumhobbit 10y ago
Traditionally they scan files, either in a batch job or on the fly, to see if the file matches a signature, basically a hash, of known viruses. This worked when there were only a couple thousands viruses in the wild. Now this approach is pointless because there are so many viruses, odds of the antivirus having seen it before are effectively zero. Not to mention countermeasures virus writers take make this even harder.
- iancarroll 10y agoSignatures are definitely not hashes. They usually match families of malware or methods of obfuscation. Nor do any respectable AVs scan after something has started running... AVs usually upload suspicious files from user PCs for further analysis to help aid in discovering new variants/types. The odds your AV has seen it is proportional to the odds of you running into it. The industry is moving away from signatures regardless. Now AVs use runtime heuristics to spot bad behavior of executables and block them even if they've never been seen; Cylance literally only does this and it's pretty effective.
- newjersey 10y agoSounds like the same old snake oil to me. > if being “part of a community” means we need to share our algorithmic, unique conviction engine with Big AV so they can steal our convictions, then yes we will not be able to meet that criteria. I have no love for Symantec but this new breed of security software can go screw itself for all I'm concerned.