User Guide - Kaspersky Lab

CHAPTER 10. PROACTIVE
DEFENSE
Warning!
There is no Application Integrity Control component in this version of the
application for computers running Microsoft Windows XP Professional x64
Edition, Microsoft Windows Vista or Microsoft Windows Vista x64.
Kaspersky Internet Security protects you both from known threats and from new
ones about which there is no information in the application databases. This is
ensured by a specially developed component – Proactive Defense.
The need for Proactive Defense has grown as malicious programs have begun to
spread faster than anti-virus updates can be released to neutralize them. The
reactive technique, on which anti-virus protection is based, requires that a new
threat infect at least one computer, and requires enough time to analyze the
malicious code, add it to the application database and update the database on
user computers. By that time, the new threat might have inflicted massive
damages.
The preventative technologies provided by Kaspersky Internet Security Proactive
Defense do not require as much time as the reactive technique, and neutralize
new threats before they harm your computer. How is this done? In contrast with
reactive technologies, which analyze code using an application database,
preventive technologies recognize a new threat on your computer by a sequence
of actions executed by a certain program. The application installation includes a
set of criteria that can help determine how dangerous the activity of one program
or another is. If the activity analysis shows that a certain program’s actions are
suspicious, Kaspersky Internet Security will take the action assigned by the rule
for activity of the specific type.
Dangerous activity is determined by the total set of program actions. For
example, when actions are detected such as a program copying itself to network
resources, the startup folder, or the system registry, and then sending copies of
itself, it is highly likely that this program is a worm. Dangerous behavior also
includes:
• Changes to the file system
• Modules being embedded in other processes
• Masking processes in the system
• Modification of certain Microsoft Window system registry keys