Antivirus Myths and Facts - Commtouch

Antivirus Myths and Facts\Myth: Antivirus software can only detect specific, known viruses1 0 1 0 0 0 1 0 0 1 1 1 1 0 0 1 01 0 0 1 1 1 1 0 0 1 1 0 1 0 0 0 11 1 0 0 1 1 0 1 0 0 0 1 0 0 1 1 01 0 0 1 1 1 1 0 VIRUS 11 0 1 0 0 0 1 0 0 1 1 1 1 0 0 1 01 1 0 0 1 1 0 1 0 0 0 1 0 0 1 1 11 0 1 0 0 0 1 0 0 1 1 1 1 0 0 1 01 0 1 0 0 0 1 0 0 1 1 1 1 0 0 1 01 1 0 0 1 1 0 1 0 0 0 1 0 0 1 1 0Fact: In the very early days of antivirus technology – around thelate ‘80s to early ‘90s – antivirus solutions were designed to detectknown malware. This solution was sufficient due to the length ofattacks, which could last weeks or months; the relatively few numberof viruses; the slow propagation of viruses, mostly via infected filesand floppy disks (the Web as we know it today was not yet born).The world today is very different, with attacks lasting hours or minutes,tens of thousands of new variants every day and widespread access tothe Web. These factors mean millions of users can be exposed to viruses in an instant. To deal with thisthreat, most antivirus engines today use a variety of approaches and technologies to detect malware,especially as-yet-unseen malware. The technologies used by antivirus solutions can be roughly categorizedinto two types: reactive and proactive.The more basic, reactive, approach to malware detection consists of using a hash or fingerprint of aninfected file. Detection is almost always exact, meaning it is an almost sure way to detect a malicioussample. It can provide an exact match between a malware or malwarefamily and its antivirus signature, which simplifies the malware cleanupprocess in the case of infection. However, due to the huge volume ofmalware prevalent today, exclusive use of signature-based detection isno longer feasible. Since every type of malware needs its ownsignature, definition file updates end up being too large, resulting inineffective use of available resources. In addition, creation ofsignatures can often take too much time to be effective.A more advanced, proactive, approach to virus detection is commonlyreferred to as heuristics. Heuristics can include a combination oftechniques such as computer instruction emulation, detection of codebehavior, rules, malicious links, etc. In essence it is behavior-basedtechnology. As part of these methods and rules, a heuristic engineMost antivirusproducts today usea combination ofreactive andproactivetechnologiesassigns scores to information and behavior found in the file. If a score exceeds a certain level, the engineindicates that malware has been detected. The advantage of this technology is that it is by nature proactive,and in most cases does not require a definition file update. Heuristic detection, however, is not exact,meaning that the chance for a false positive (incorrect identification as malware) is greater than withsignatures.To ensure the most accurate virus detection, most antivirus products today use a combination of reactive andproactive technologies – signature/fingerprint/hash approaches and heuristics – in order to take advantageof each one’s strengths and minimize weaknesses. There is, however, a general trend towards increased useof heuristics, due to their capability of early detection as well as their speed.Testing the proactive capabilities of an antivirus is best done with the most recent virus sets. Some testingorganizations actually disable the signature update capabilities of an antivirus in order to evaluate itsdetection of these newer viruses (one week old) for which it has not yet downloaded signatures.Page| 3blog.commtouch.comwww.commtouch.com