Security vendors leaving old-school malware detection behind

Signature-based virus scanning losing prominence as use of behavior-based detection and reputation analysis grows

Step 1: Identify a computer virus specimen. Step 2: Create a "signature" to detect and eradicate the virus, and push the signature file out to a computer. Step 3: Repeat steps 1 and 2 again and again for new viruses and their variants.

That's how virus fighting has been done for decades in the antivirus software industry. But now some of the industry's biggest players say this methodology will be in decline in 2009 due to the rapidly multiplying malware epidemic.

Signature-based scanning is "static, old school," says Jerry Egan, director of product management at Symantec's security technology and response division. With 12,000 new malware specimens each day to detect and eradicate, "we think that technique is reaching the end of its useful life," Egan says.

Another complication is that malware is now so artfully designed, "it spreads to 20 or 30 machines before it mutates," Egan points out. That means "your neighbor has one variant and you have another. The effectiveness of each signature has gone down."

While Symantec isn't quite ready to jettison signature-based detection, the coming year is going to see a shift toward other antimalware techniques, including behavior-based protection, heuristics such as examining good and bad file characteristics, reputational analysis, and even whitelisting and blacklisting to allow or disallow code to run, says Egan.

"The shift will be to a hybrid model that employs these," Egan says about Symantec's product development going forward.

The view about signature-based detection is not so different at Trend Micro and Kaspersky Lab.

"Our experience is that there has been a 700% increase this year over last year alone in malware," says Peter Beardmore, senior product marketing manager at Kaspersky Lab. "This is absolutely challenging the traditional approach to signatures."

Kaspersky sees its detection model shifting, too. "Rather than the pattern of code, there's a pattern of calls made in that code," says Beardmore. "It might be calling the printer or registry," so the malware would be identified through more behavior-based methods.

Kaspersky will also be adding to all its desktop products the whitelisting and blacklisting approach it tried in its consumer products last summer through a partnership with Bit9. These technologies seem more adapted to the desktop right now, so Kaspersky hasn't pinpointed a strategy for this use in servers yet.

Join the PC World newsletter!

Error: Please check your email address.

Tags kaspersky labsmcafeemalware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ellen Messmer

Network World
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?