3 ms·

On a less related note, beyond the shiny GUI layer, just how advanced is today's antivirus software anyway? Do they still primarily rely on signature detection

On a less related note, beyond the shiny GUI layer, just how advanced is today's antivirus software anyway? Do they still primarily rely on signature detection? I know that modern systems also perform what's broadly titled "heuristic analysis", but I'm not sure what that specifically entails. Is there any form of system call tracing, sandboxing, file monitoring or what?

philip1209 12y ago
A lot of modern malware prevention focuses on monitoring network traffic. Rather than rely on a single machine to self-report its health, technologies monitor the main channel of infection and data transmission, which is communication with the internet. Examples: - FireEye - OpenDNS (where I work) - Palo Alto Networks - ZScalar Case in point - at OpenDNS, we can often identify signs of infection (e.g. communication with DGA domains) before pinpointing the particular malware involved.
SCHiM 12y ago
Heuristics look at what a process is doing. For example, a very simple heuristic rule may look like this: if a process does the following: Open another .exe file then Writes to that .exe file Close that .exe file Then it's a virus. Such 'rules' are then used by the detection engine of the anti-virus software, if a program triggers any of these rules it is often labeled as a 'generic' Trojan or virus. Often this tracking is achieved by 'hooking' syscalls of your operating system. But some anti-virus programs also employ emulation and/or sandboxing. Comodo is an example that does sandboxing. Recent developments in anti-virus are what's called 'host-based protection'. Instead of relying on blacklists, such as heuristics and signatures, a custom made 'profile'(whitelist) of the host is made which looks at which applications are installed and what they should be doing. For example: your browser should never attempts to start another process. If it does it means something is wrong. Such host based approaches can detect unknown threats/exploits as they happen. If your browser is exploited and tries to download and execute malware, the system will detect it because it was previously established that your browser has no business starting other applications.
xorcist 12y ago
Signature based antivirus, as in "after the fact"-heuristics, remains the most useful. Because, as advanced as the other methods may be, their usefulness remains limited by their public existence. Any malware writer checks their creations against VirusTotal and change it as long as anything flags.

philip1209 12y ago

A lot of modern malware prevention focuses on monitoring network traffic. Rather than rely on a single machine to self-report its health, technologies monitor the main channel of infection and data transmission, which is communication with the internet. Examples: - FireEye - OpenDNS (where I work) - Palo Alto Networks - ZScalar Case in point - at OpenDNS, we can often identify signs of infection (e.g. communication with DGA domains) before pinpointing the particular malware involved.

SCHiM 12y ago

Heuristics look at what a process is doing. For example, a very simple heuristic rule may look like this: if a process does the following: Open another .exe file then Writes to that .exe file Close that .exe file Then it's a virus. Such 'rules' are then used by the detection engine of the anti-virus software, if a program triggers any of these rules it is often labeled as a 'generic' Trojan or virus. Often this tracking is achieved by 'hooking' syscalls of your operating system. But some anti-virus programs also employ emulation and/or sandboxing. Comodo is an example that does sandboxing. Recent developments in anti-virus are what's called 'host-based protection'. Instead of relying on blacklists, such as heuristics and signatures, a custom made 'profile'(whitelist) of the host is made which looks at which applications are installed and what they should be doing. For example: your browser should never attempts to start another process. If it does it means something is wrong. Such host based approaches can detect unknown threats/exploits as they happen. If your browser is exploited and tries to download and execute malware, the system will detect it because it was previously established that your browser has no business starting other applications.

xorcist 12y ago

Signature based antivirus, as in "after the fact"-heuristics, remains the most useful. Because, as advanced as the other methods may be, their usefulness remains limited by their public existence. Any malware writer checks their creations against VirusTotal and change it as long as anything flags.