Security vendors leaving old-school malware detection behind

Signature-based virus scanning losing prominence as use of behavior-based detection and reputation analysis grows

Step 1: Identify a computer virus specimen. Step 2: Create a "signature" to detect and eradicate the virus, and push the signature file out to a computer. Step 3: Repeat steps 1 and 2 again and again for new viruses and their variants.

That's how virus fighting has been done for decades in the antivirus software industry. But now some of the industry's biggest players say this methodology will be in decline in 2009 due to the rapidly multiplying malware epidemic.

Signature-based scanning is "static, old school," says Jerry Egan, director of product management at Symantec's security technology and response division. With 12,000 new malware specimens each day to detect and eradicate, "we think that technique is reaching the end of its useful life," Egan says.

Another complication is that malware is now so artfully designed, "it spreads to 20 or 30 machines before it mutates," Egan points out. That means "your neighbor has one variant and you have another. The effectiveness of each signature has gone down."

While Symantec isn't quite ready to jettison signature-based detection, the coming year is going to see a shift toward other antimalware techniques, including behavior-based protection, heuristics such as examining good and bad file characteristics, reputational analysis, and even whitelisting and blacklisting to allow or disallow code to run, says Egan.

"The shift will be to a hybrid model that employs these," Egan says about Symantec's product development going forward.

The view about signature-based detection is not so different at Trend Micro and Kaspersky Lab.

"Our experience is that there has been a 700% increase this year over last year alone in malware," says Peter Beardmore, senior product marketing manager at Kaspersky Lab. "This is absolutely challenging the traditional approach to signatures."

Kaspersky sees its detection model shifting, too. "Rather than the pattern of code, there's a pattern of calls made in that code," says Beardmore. "It might be calling the printer or registry," so the malware would be identified through more behavior-based methods.

Kaspersky will also be adding to all its desktop products the whitelisting and blacklisting approach it tried in its consumer products last summer through a partnership with Bit9. These technologies seem more adapted to the desktop right now, so Kaspersky hasn't pinpointed a strategy for this use in servers yet.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwaremcafeekaspersky labs

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ellen Messmer

Network World
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?