The sorry state of Avira anti-virus heuristics • Hacker News Board

Re: The sorry state of Avira anti-virus heuristics

#11

Post by Blasa » Thu, Mar 18, 2010, 12:02 AM UTC

Periodic wrote: post #6

bad_user wrote: post #5

Earlier quoted context omitted.

I'm pretty sure the future of anti-viruses will involve signature matching one way or another, because there's no way around that. Viruses are pretty similar to their biological counterparts ... they are pretty useless by themselves, but once they infect a host, they can use its mechanisms to multiply. Antibiotics are targeting bacterial infections successfully because bacterial cells can be recognized (have their ow…

When it comes to recognizing current infections we're always going to have to deal with signatures, though we have the ability to match on behavior as well as code. We might look for things that are run out of the users directories that modify system-wide settings, for example. I think there's a fundamental difference and that is that we can have a central security mechanism in a computer. It's not too hard to link a…

For those that haven't come across it before the object-capability model deals with this sort of problem.

http://en.wikipedia.org/wiki/Object-capability_model

Edit: That of restricting each process to only be allowed to do certain things.

Re: The sorry state of Avira anti-virus heuristics

#12

Post by Retric » Thu, Mar 18, 2010, 12:07 AM UTC

tsally wrote: post #7

bad_user wrote: post #5

Earlier quoted context omitted.

I'm pretty sure the future of anti-viruses will involve signature matching one way or another, because there's no way around that. Viruses are pretty similar to their biological counterparts ... they are pretty useless by themselves, but once they infect a host, they can use its mechanisms to multiply. Antibiotics are targeting bacterial infections successfully because bacterial cells can be recognized (have their ow…

Analogies between computer viruses and biological viruses are strained, overused, and abused. I'll just point out that our innate immune system doesn't use signature based detection, it uses a whitelist and behavioral/heuristic based detection. Where do you think transplant rejection comes from? It's not because the immune system has a virus signature that matches the foreign organ. I'm pretty sure the future of anti…

Your immune system uses a wide range of methods to find and fight infection. However, while identification is based on finding things outside of the "Normal" range, fighting it is all about signatures.

Vaccination works by preparing the body to fight something that looks like X by dumping millions of copy of something that looks like X into your body. At which point your immune system feels it needs to really fight X with everything it has so it develops a specific response. aka Adaptive immunity is triggered in vertebrates when a pathogen evades the innate immune system and generates a threshold level of antigen. SEE: http://en.wikipedia.org/wiki/Adaptive_immune_system

This is also why you can have auto immune diseases, if you trip the "fight" response to something that should be left along you get a world of problems. You immune system is more than willing to kill cancer, or even normal cells, and inflammation can be vary harmful.

Re: The sorry state of Avira anti-virus heuristics

#13

Post by tsally » Thu, Mar 18, 2010, 12:14 AM UTC

Retric wrote: post #12

tsally wrote: post #7

Earlier quoted context omitted.

Analogies between computer viruses and biological viruses are strained, overused, and abused. I'll just point out that our innate immune system doesn't use signature based detection, it uses a whitelist and behavioral/heuristic based detection. Where do you think transplant rejection comes from? It's not because the immune system has a virus signature that matches the foreign organ. I'm pretty sure the future of anti…

Your immune system uses a wide range of methods to find and fight infection. However, while identification is based on finding things outside of the "Normal" range, fighting it is all about signatures. Vaccination works by preparing the body to fight something that looks like X by dumping millions of copy of something that looks like X into your body. At which point your immune system feels it needs to really fight X…

It's not all about the signatures. Vaccination would be just as ineffective as anti-virus if biological viruses were anything like computer viruses. Imagine billions of biological viruses that are instantly transmitted upon infection to anywhere in the world, have an immediate impact on the host, and can evolve and adapt with human-like intelligence. Good luck fighting that with vaccines.

Because computers are not human beings, if we can do detection well, than the problem of fighting an infection is already solved. Just run your server on a virtual machine verified by a trusted boot module. When an infection is detected, just roll back to a trusted snapshot or roll back to a clean install.

Re: The sorry state of Avira anti-virus heuristics

#14

Post by thaumaturgy » Thu, Mar 18, 2010, 12:57 AM UTC

Avira is well-known in A/V for producing higher false positives than most other competing products.

That said, it also (as of late last year) had the highest actual detection rate (at 74% of 20,000+ tested bits of malware).

It also won AV Comparative's "gold" award for 2008, there's still a free version available for personal use, and it offers one of the lowest impacts on system performance of any antivirus product.

So, although I agree with the author that the heuristics in this case aren't optimal, Avira is still a very good product overall.

Re: The sorry state of Avira anti-virus heuristics

#15

Post by Retric » Thu, Mar 18, 2010, 4:06 AM UTC

tsally wrote: post #13

Retric wrote: post #12

Earlier quoted context omitted.

Your immune system uses a wide range of methods to find and fight infection. However, while identification is based on finding things outside of the "Normal" range, fighting it is all about signatures. Vaccination works by preparing the body to fight something that looks like X by dumping millions of copy of something that looks like X into your body. At which point your immune system feels it needs to really fight X…

It's not all about the signatures. Vaccination would be just as ineffective as anti-virus if biological viruses were anything like computer viruses. Imagine billions of biological viruses that are instantly transmitted upon infection to anywhere in the world , have an immediate impact on the host , and can evolve and adapt with human-like intelligence . Good luck fighting that with vaccines. Because computers are not…

Remember less than 1/2 the cells in your body actually contain your DNA. Yet signatures still work. Biological viruses are light years ahead of computer viruses. Picture a world where there where more computer virus strains than computers, they mutated millions of times a second, ignored firewalls and could attack computers though the electrical system. Further 1/4th of every nations GDP went to anti virus systems and had been for the last billion years.

PS: Virus writers have become far more tame but old school virus's would rewrite your BIOS.

Re: The sorry state of Avira anti-virus heuristics

#16

Post by theblackbox » Thu, Mar 18, 2010, 11:36 PM UTC

tsally wrote: post #10

theblackbox wrote: post #9

Earlier quoted context omitted.

any idea where I could learn more about curent implementations of (1) ?

Find a video of this Blackhat talk from 2005. Pretty sure it's in the iTunes store in the podcast section. The video covers pretty much everything you need to know about the theory of such systems. http://www.blackhat.com/html/bh-usa-05/bh-usa-05-speakers.ht... As far as actual implementation, I'm not aware of a system that does this. Although honestly some researcher has probably implemented such a system in a paper…

Good luck. And thanks for the links, I'll be looking into it. You mind a PM if it get's interesting (just to bounce ideas off someone)? I'm looking into machine learning stuff myself and can imagine some interesting integrations with this subject.

Re: The sorry state of Avira anti-virus heuristics

#17

Post by tsally » Fri, Mar 19, 2010, 3:27 AM UTC

theblackbox wrote: post #16

tsally wrote: post #10

Earlier quoted context omitted.

Find a video of this Blackhat talk from 2005. Pretty sure it's in the iTunes store in the podcast section. The video covers pretty much everything you need to know about the theory of such systems. http://www.blackhat.com/html/bh-usa-05/bh-usa-05-speakers.ht... As far as actual implementation, I'm not aware of a system that does this. Although honestly some researcher has probably implemented such a system in a paper…

Good luck. And thanks for the links, I'll be looking into it. You mind a PM if it get's interesting (just to bounce ideas off someone)? I'm looking into machine learning stuff myself and can imagine some interesting integrations with this subject.

Definitely don't mind.

Email: tss AT timsally DOT com

Public key if you need: http://www.timsally.com/static/tss.asc

I'm presenting a metamorphic engine at a hacking conference in April (http://thotcon.org/). It'll be completely open source. Initial tests against modern anti-virus look very good. ;)