本帖最后由 月影天心 于 2016-10-12 23:20 编辑
为方便更多想了解小a的朋友，决定发在国外大区，版主好心麻烦别给移了位：）
先来张国际官网的妹纸，真不错~
来自捷克共和国的Avast！一直是我最喜爱的杀软之一，几台电脑总有一台要装着小a。众所周知，avast！在12版本引入了全新的CyberCapture技术，简而言之，CyberCapture是一个未知文件实时云端分析的技术。很多小a的用户发现在装了新版本的小a后，CyberCapture可以说毫无存在感。CyberCapture究竟是什么？运行的原理和机制又是怎样的？下面，本人原创翻译由avast！官方提供的CyberCapture技术介绍，分享给论坛里的大家。
先来看官网对该技术的简单介绍：
确实介绍的十分简单，等于没介绍。
正文开始。
原著：Ondrej Vlcek（这家伙是Avast的EVP & GM, Consumer）
CyberCapture: Protection against zero-second attacks [infographic]
一段综述：
This new technology was developed by Avast’s Threat Labs to analyze unrecognized files that have never been seen before. We receive approximately 800,000 files a day, and about half of them are unknown. CyberCapture isolates unknown files in a safe environment and automatically establishes a two-way communication channel with you and Avast’s team of expert security analysts. This ensures that you are protected from any new threats before you open a potentially dangerous file.
这项新技术是由avast的威胁实验室开发的用于分析识别从未见过的文件。我们每天收到大约80万个文件，其中大约有一半是未知的。CyberCapture在一个虚拟的安全环境中分析未知文件，并自动建立一个你和Avast团队安全分析专家双向沟通的渠道。这将确保您在打开一个具有潜在危险的文件之前保护你免受任何新生威胁。
One of the new ways we are increasing protection is with a cool new proprietary technology called CyberCapture. CyberCapture dramatically raises the bar when it comes to protection against zero-second attacks.
我们研发了一种很酷的新的专利技术，即CyberCapture来作为我们提升保护的新途径。CyberCapture将大大提升系统对零日威胁的防护能力（PS：本文把zero-second都统一翻译成零日）。
The threat landscape has significantly evolved in recent years and malware has become a lucrative business for cybercriminals. Threats are becoming more sophisticated and the life span of malware has drastically changed with the heavy use of server polymorphisms and targeted attacks. Server polymorphism is where one malware sample targets a single user before the code morphs into a new sample and attacks the next user, enabling zero-second attacks that are very difficult to prevent using traditional protection methods. Since samples constantly morph, their life spans are radically shortened, allowing cybercriminals to focus on big and quick campaigns to hit the maximum number of victims within the shortest time frame possible. CyberCapture detects morphed, yet-unknown files in real time and thus protects you from zero-second attacks.
近几年，我们面临不断进化的复杂威胁环境，制造恶意软件已成为网络犯罪分子牟取利益的行业。威胁变得越来越复杂，随着多种和有针对性地攻击不断涌现，恶意软件的生命周期被彻底改变了。多样的攻击行为就是说一种攻击单用户的恶意软件样本在不断演变之前攻击下一个用户，导致零日攻击，这类攻击通过传统的方法很难保护。由于样本的不断演变，它们的生存周期从根本上缩短，让网络罪犯能在最短的时间内集中最高强度和速度攻击最大数量的受害者。CyberCapture实时检测正在演变产生，暂时未知的文件，从而保护您免受零日攻击。
In a nutshell, CyberCapture is a cloud-based smart file scanner. Rather than relying on the latest definition updates, CyberCapture isolates suspicious files in a safe environment and automatically establishes a two-way communication channel with the Avast Threat Labs for immediate analysis. This allows us to clear away all the false code, misdirection, and other stuff malware creators use to mask malware’s true intentions. By peeling away layers of obfuscated code in the cleanroom environment of our cloud, CyberCapture is able to fully dissect the file and observe the binary level commands inside the malware and fully understand the instructions hidden there.
简而言之，CyberCapture是一个基于云计算的智能文件扫描仪。它不依靠最新的定义更新，CyberCapture塑造一个安全的虚拟环境隔离可疑文件，并自动建立一个双向连接渠道令avast威胁实验室即时分析这些文件。这使我们能够清除所有的错误代码，以及识别恶意软件的创造者们隐藏起来的真实意图。在我们洁净的云端剥去伪装的代码外壳，CyberCapture能够深入恶意软件充分剖析文件二进制级别的命令，完全了解其中隐藏的指令。
CyberCapture evolved from our DeepScreen technology, which used to analyze unknown files locally, in a virtualized “sandbox” environment. DeepScreen had two major problems, though. First, it relied on the NG virtualization component, which wasn’t compatible with all systems (it required certain settings to be enabled in the system BIOS etc.). And second, it allowed the suspicious file to run in the sandbox for only a very short time (typically 10-15 seconds), dramatically reducing the precision of the decision-making algorithm. By moving the technology to the Cloud, and taking all the time needed to properly analyze the file, we are now adding an additional layer of protection that will be extremely difficult for attackers to beat.
CyberCapture从我们的DeepScreen技术发展而来，一种在一个虚拟的沙箱环境下分析未知文件的技术。然而DeepScreen有两个主要的问题，首先，它依赖于NG虚拟化组件，无法与所有的系统兼容（这需要在系统BIOS中进行设置以启用）；其次，它允许可疑文件运行在沙箱中只有很短的时间（通常为10~15秒），大幅降低了决策算法的精度。我们现在将技术移动到云端，花费时间以正确分析文件，为你增加了一个额外的保护层，实施成功的攻击和犯罪行为将变得极其困难。
While developing CyberCapture, we put a great deal of effort into shortening the time between malware discovery and the deployment of a detection. We moved the technology to the cloud, so that we can leverage all of our heavy weapons to analyze samples in a controlled environment. Typically, the automated analysis will need up to two hours to make a reliable decision about the file. In certain cases, it will not be possible for our engines to make that decision, which is where our experienced analysts will step in to manually analyze the file. During that time, the file is still contained in the “capture” and hence cannot cause any harm. Once the analysis is complete, the user is notified about the result and the file is either quarantined or released from the capture and allowed to run.
发展CyberCapture过程中，我们投入了大量的精力来缩短恶意软件检测入库的时间。我们把这一技术转移到云端，这样我们就可以利用我们所有的重型“武器”在受控环境中分析样本。通常情况下，自动分析需要长达两个小时才能对文件作出一个可靠的决定。在某些情况下，我们的引擎可能无法作出准确判断，这就需要我们的经验丰富的分析师手动分析文件。文件被上传分析期间，该文件仍然处于被“捕获”状态，因此不会造成任何伤害。一旦分析完成后，用户就会收到分析结果的通知，文件或被隔离或被解封并允许运行。
CyberCapture is a new system and will take a bit of time to become fully tuned and productive. Because of the nature of its operations, CyberCapture continually gathers intelligence on new viruses. This means it will organically improve as it is used and, therefore, it will continue to iterate increased performance.
CyberCapture是一个新的系统，需要一些时间来调试。由于其技术性质，CyberCapture不断收集新的病毒情报，这意味着它将不断自我进化，提升性能。
Here at Avast we are all excited about the technology and are big believers in its potential. Our team has been working very hard to keep our users around the world safe and secure, and CyberCapture is going to be a critical part of this effort.
在Avast，我们对研发此项技术充满激情，完全确定该技术拥有广阔的发展前景。我们的团队一直非常努力地工作来维持我们全球用户的安全，CyberCapture将是我们践行这项使命的关键所在。
原创翻译，转载请注明卡饭论坛-月影天心，谢谢！
PS 1：
新的Avast云端分析产品称为Nitro，官方称其为Our newest, high-speed version of Avast Antivirus，CyberCapture是Nitro中6个核心技术之一，其余5项创新或改良是：Lower System Impact、New Monthly Product Updates、Leading HTTPS Security、Improved Home Network Security、Enhanced SafeZone Browser。
PS 2：
更详细的Avast！指南，请参见本人撰写的此帖：小巧、精致、好用——新版本Avast！简易指南V2.0（低误报、高查杀、不卡机)，基于当时最新的11版本写的，当时还是CyberCapture的前身DeepScreen，其它改变不大，推荐设置同样适合于当下版本，就是网页防护部分，除了关闭“扫描恶意URL”降低误报，敏感度可以开高了；此外，扫描部分也推荐把启发调最高，放心，除网页扫描会报一堆稀里古怪的玩意外，avast！的误报很低，个人感觉比较适合国内环境。供大家参考（有时间会根据当前版本avast！的一系列功能变化写3.0）。
接下来就是友情赠送，Avast！的捷克总部，看看世界级安全企业和你想象中是否差不多呢~十几张图，耐心点~
来自Avast! worldwide。
累死了，吃晚饭去了。。。
欢迎指正~
话说Avast！的新Logo真的好萌~
|
[复制链接]
发表于 2016-10-12 20:23:24
。这可是云安全的基础功能啊，难道Avast之前和金山一样靠人工？而且动态启发除了都是要使用虚拟环境之外和这个并没有关系。楼主能不能找到更深入讲解的文章？也许亮点在算法上。
楼主