关于CyberCapture（补图）

Q1628393554

更新：
最新内容大家请参考此帖https://forum.avast.com/index.php?topic=187679.0
概况说来，引用 欧阳宣 的话

这个功能只能检测来自http/https的下载文件，来自USB，ftp，电子邮件，p2p协议的文件均不在囊括范围内

——————————————————————————————————————————————————
CyberCapture 是这次的一大改进，但资料很少，给出官人6月8号的描述作为参考，现在是否如此暂不清楚。求大神科普。

In general CyberCapture is cloud analysis of new/unique/unknown files. When we detect a new file on user's computer we send it to our cloud for further and deeper analysis. We run it in our "NG" farm to watch how it behaves, we test it against our extended VPS, and few via other checks and at the end we got a result if the file is clean or not. Then this message is delivered back to the client.

During the analysis the file stays locked, but user can delete it or run anyway (this is not recommended)

The analysis might take few hours, but we work hard to deliver the result asap.

This feature can be disabled via Settings->General.


We try to decide asap, and in fact in large portion of files we are able to decide in matter of minutes but some files need more time, for now.

Analysis time can be specific for each sample. Imagine case (which is not that rare) of sample "hiding" malicious activity after i.e. 2 minutes of running after execution.

Yes we will display a usual time needed for analysis, calculated from the last 24h. But as Milos said some files might take longer. It will be just indicative, not precise.

来源：https://forum.avast.com/index.php?topic=187104.0

欧阳宣

https://forum.avast.com/index.php?topic=187679.0

这个功能只能检测来自http/https的下载文件，来自USB，ftp，电子邮件，p2p协议的文件均不在囊括范围内

樱花の雨

貌似主动防御

驭龙

发现新文件或者未知文件，先锁定文件，然后把文件上传Avast云服务器，需要几个小时甚至是更长时间分析完成，之后反馈给客户端处理？这确实是跟其他的云不同啊（有一点WD行为遥测分析的味道），不过这个等待过程有一点无奈，但理论上方法是不错的

ccboxes

简单来说，就是类似火眼的自动分析系统，只不过集成在实时监控中，发现未知文件立即上传？

海龙王_ccmd

不知这个新的设置是否适合国内使用，再就是到底性能如何，经过了这么长时间的测试……

为你心碎

不错的改进，看效果如何

Q1628393554

ccboxes 发表于 2016-6-22 18:57
简单来说，就是类似火眼的自动分析系统，只不过集成在实时监控中，发现未知文件立即上传？

你这一说火眼，还真有点像啊

追影子的十三

我倒感觉像卡巴的KSN。

大家用的越多，上传的越多，白名单越多

900703

網路不好就........

白露为霜

可能效果比原来本地DeepScreen强一点，云服务器的分析能力

先锁定文件，上传服务器，几小时或更多时间...

那新文件怎么办，一直等他分析完吗

原来主楼有

but user can delete it or run anyway (this is not recommended)

反应速度是硬伤啊3@Q1628393554