饭友皇甫暮云对Suspicious.Cloud病毒名称的解释有待商榷

尘梦幽然

无处不在--浅析诺顿智能社区2.0之重要作用
http://bbs.kafan.cn/forum.php?mo ... 8&fromuid=50558

在以上帖子的4L中，皇甫暮云说道：

虽然在很多的情况下，诺顿智能社区会向用户发送文件信誉的参考信息，但是对于信誉值过低的文件，诺顿是会立刻做出处理的。如果看到文件被"suspicious.cloud"隔离，则说明可能是由于文件信誉值偏低而被诺顿暂时隔离。

但是说我不认为是如此，原因如下：
我在官网以“Suspicious.Cloud”为关键词查询时查到了Suspicious.Cloud.2/3/5等威胁种类，它们的总结性描述一致为：

Suspicious.Cloud.5 is a detection technology designed to detect entirely new malware threats without traditional signatures. This technology is aimed at detecting malicious software that has been intentionally mutated or morphed by attackers.

这个描述仅提到了Suspicious.Cloud是恶意软件启发式技术侦测的威胁，完全没有提到与信誉有关的任何判定依据。
而平常大家最熟悉的WS.Reputation.1的报毒种类中，是这样描述它的：

WS.Reputation.1 is a detection for files that have a low reputation score based on analyzing data from Symantec’s community of users and therefore are likely to be security risks. Detections of this type are based on Symantec’s reputation-based security technology. Because this detection is based on a reputation score, it does not represent a specific class of threat like adware or spyware, but instead applies to all threat categories.
The reputation-based system uses "the wisdom of crowds" (Symantec’s tens of millions of end users) connected to cloud-based intelligence to compute a reputation score for an application, and in the process identify malicious software in an entirely new way beyond traditional signatures and behavior-based detection techniques.

也就是说WS.Reputation的报法是基于赛门铁克智能社区技术的，是一种超越传统特征码、行为防护检测的检测方式。文件因信誉过低被报毒应该是有专门的分类报法。
所以，我认为Suspicious.Cloud的报法与“信誉偏低”可能没有直接关系，或许会是类似SONAR查询文件云信誉那样的间接判定威胁的关系。

最后附上官网文献：
1.WS.Reputation.1：http://www.symantec.com/security ... 2010-051308-1854-99
2.Suspicious.Cloud.5：http://www.symantec.com/security ... 2010-090200-2232-99

symantec001

不懂

jaygarven

简单点就是说 铁壳不会用三人成虎的态度定义病毒 看他平时入库那速度就想到了

dopod2009

刚好昨天被误报了一个文件，上传截图看看就清楚了

WS.Reputation命名是社区信誉，而Suspicious.Cloud是启发
有可能是侦测由下载智能分析出现，导致佳哥出现一点小失误吧

ywsuda

同意。Suspicious.Cloud经常是启发。而WS.Reputation是下载分析经常出现。应该是靠社区信誉

zhym91

nice job！

zhoujianz

学习了~ 顶LZ

ujty

不是用于侦测没有传统签名的恶意程序的么，那算不算信誉值低呢。

皇甫暮云

en, roger that. thanks for sharing

wanglei7865

样本区一般都说这个是云启发