by Mike Masnick

More Calls For Behavior-Based Virus Fighting

from the of-course dept

It's no surprise to see this article so soon after such a major virus outbreak. People are wondering, yet again, how come our anti-virus systems work in a reactive way - after discovering a virus, pushing out an updated virus definitions file to protect subscribers. The problem, of course, is that this only happens well after the virus is in circulation. So, once again, we get calls for more pro-active, behavior-based anti-virus protection. Since the last big virus outbreak, a few such products have started appearing on the market. Though the initial offerings are mostly focused on enterprise users, they're likely to trickle down pretty rapidly. Still, I stand by my earlier prediction that behavior-based virus fighting will have unintended consequences. First, it will end up blocking/stopping certain legitimate behaviors that the system interprets incorrectly as virus activity. Second, it will just encourage virus writers to adapt and start writing viruses that piggyback on legitimate uses in order to sneak past the filters. It's pretty clear that current anti-virus methods aren't working, but behavior-based anti-virus fighting may not be the best solution either.

Reader Comments

Subscribe: RSS

View by: Time | Thread

  • identicon
    Matt, 30 Jan 2004 @ 5:34am

    No Subject Given

    in any case I would think that most antivirus companies faced with:
    a) write whizzbang software that solves all virus problems forever
    b) have a tasty monthly revenue from people downloading updates to signature files
    are going to go with b) even if a) were possible

    reply to this | link to this | view in chronology ]

  • identicon
    aNonMooseCowherd, 30 Jan 2004 @ 7:47am

    mind-reading virus detection

    "Behaviour patterns"? I supposed he would treat any program that deletes files as a virus because that's one behavior of a virus. Sounds like he's asking for software that can read minds.

    reply to this | link to this | view in chronology ]

  • identicon
    Mikester, 30 Jan 2004 @ 10:26am

    Not likely

    I would imagine in order for this to work, the AV software would have to reverse-engineer in some way each attachment/software/file passing under it's nose in order to see what the intentions are. That's probably a big no-no under the DMCA and would surely be challenged in court by someone very quickly.

    reply to this | link to this | view in chronology ]

Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Techdirt Gear
Shop Now: Copying Is Not Theft
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Report this ad  |  Hide Techdirt ads
Recent Stories
Report this ad  |  Hide Techdirt ads


Email This

This feature is only available to registered users. Register or sign in to use it.