Security researchers plot revamped anti-virus tests
Behaviour-based testing
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Security researchers are close to formulating plans to overhaul anti-virus testing amid growing concerns that current tests can be misleading.
Anti-virus packages are traditionally tested for their effectiveness in detecting a sample of malware packages known to be in circulation. Products that fail to detect a sample get a lower rating. Such tests - which have remained almost unchanged for a decade - essentially test signature detection of malware samples. Products that fail to detect a sample fail to achieve coveted benchmarks, such as the VB 100 endorsement.
But the approach is a poor method for detecting the effectiveness of behavioral detection technology, an approach that is increasingly gaining traction in the marketplace as a means of providing detection for rapidly evolving threats. In the era of targeted Trojan attacks, some based on unpatched vulnerabilities, signature detection alone really fails to provide a complete defence, however highly a product is rated on those terms.
German testing organisation AV-Test.org is pooling suggestions for a revamp to current testing regimes, taking ideas from vendors such as Symantec, Trend Micro, Panda Software, Kaspersky Labs and others, IDG reports. The revamped tests are likely to involve presenting malware samples as an email attachment or as malicious code on web pages within a testing environment.
Security packages (either anti-virus or host-based intrusion prevention) put through their paces in the tests are likely to have been put on ice, without signature update, for a few weeks prior to the tests. The approach is designed to put the onus on detecting viral code on behavioural analysis features in security packages. The new tests be carried out alongside traditional tests, though that and the scoring systems for behaviour-based tests still remain open to debate.
Proposals for a new testing regime, which have the support of other influential testers such as Virus Bulletin, are due to presented next month at the Association of AntiVirus Asia Researchers 2007 conference in Seoul, South Korea. ®
COMMENTS
Blank signature file
Anonymous Coward: Yes, theoretically, it is possible. In practice, however, it is not. First of all, practically no AV vendor will supply you with a "blank signature file". We (F-PROT) used to do it only for our macro malware signatures and nowadays even we don't do it any more. Furthermore, the term "signature" is misleading. Contrary to popular belief, it's not a collection of scan strings for known malware. Nowadays it is a complex database containing whole programs for detecting malware. Often even the scanning engine of the AV product is updated by this database. So, if you use an old database, you're running the risk of using an old (even buggy) AV engine.
It sounds like a great idea to me.
They want to test the ability to protect against previously unknown threats.
The best way to obtain test against unknown threats would bet to travel one week into the future and obtain the latest real world nasties.
However until they get their time travel machine working, they decided to do the next best thing.
Today's threats vs AV software that has been frozen in time for a week.
As far as it being unfair because the AV software doesn't have the latest updates, I wish I lived in a world where AV software became dramatically more effective on a week to week basis. :)
Up-to-date heuristics/out-of-date signatures
Is it not possible to mate, for the purposes of testing, an old or even blank/minimal signature file with the latest heuristic engine if you want to test the capacity of the heuristics to detect threats?
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
