[转贴] NOD32 和卡巴较上劲了 BY alphabeta

起点

NOD32 和卡巴较上劲了

在卡巴的 BLOG 中有一篇启发式和行为分析的对比文章 >)q[*]2*
LbP ts.,
里面阐述了行为分析相对启发式的优点 = _~]32!7
N$J.$DhzwD
结果 NOD32 前几天也在自己的 BLOG 中发表文章 \f(XcM6lM
/ZQSFHCf 
说明了启发式相对行为分析的优点

英文,可以用 www.google.com 上得语言工具翻译

卡巴的那篇

Virus attacks have firmly established themselves as the leading IT security threat. Not only do they result in financial losses, but they also serve as a vehicle for many other security threats, such as the theft of confidential information and unauthorized access to sensitive data. The antivirus industry has responded by coming up with a number of new approaches to protecting IT infrastructures - to name a few, these include proactive technologies, emergency updates during outbreaks, significantly more frequent antivirus database updates, etc. This paper is the first in a series of articles that will provide more information on the newest technologies used by antivirus companies and help users to judge the effectiveness of these technologies more objectively. In this article, we will focus on proactive technologies. Ha%6NShc
BID?uVPcJ
Virus attacks cause enormous damage and, equally important, the number of types of malicious code is growing at an increasing rate. In 2005, growth in the number of malicious programs exploded: according to Kaspersky Lab, the average number of viruses detected monthly reached 6,368 by the end of the year. Overall growth for the year reached 117% compared with 93% for the previous year. X\AmE"5B
*8mJxKnb
Likewise, the nature of the threat itself has changed. Malicious programs are not only much more numerous, but also significantly more dangerous than ever before. The antivirus industry has responded to the challenge with a number of new approaches to antivirus protection, including proactive technologies, shorter response times to new threats that can cause outbreaks, as well as more frequent antivirus database updates. This article provides a detailed analysis of the proactive protection, often promoted by vendors as a panacea for all existing and even all possible viruses. KT7q3Bt$l
3},?c4}?
An Introduction to Proactive Technologies 5 dFd2,
Contemporary antivirus products use two main approaches to detect malicious code - signature-based and proactive/heuristic analysis. The first method is sufficiently simple: objects on the user’s computer are compared to templates (e.g., signatures) of known viruses. This technology involves continually tracking new malicious programs, and creating their descriptions, which are then included in the signature database. Therefore, an antivirus company should have an effective service for tracking and analyzing malicious code (that is, antivirus lab). The main criteria used to evaluate how effectively the signature-based approach is implemented include new threat response times, frequency of updates and detection rates. Ys$3}LA{
WnP,,%^
The signature-based method has a number of obvious shortcomings. The primary disadvantage is the delayed response time to new threats. There is always a time lag between the appearance of a virus and the release of its signature. Contemporary viruses are capable of infecting millions of computers in a very short time. pR2BEP)JW_
u6\;uO
Thus, proactive/heuristic methods of virus detection are becoming increasingly popular. The proactive approach does not involve releasing signatures. Instead, the antivirus program analyzes the code of objects scanned and/or the behavior of the applications launched and decides whether the software is malicious based on a predefined set of rules. IBVuQH
rF8vBsV 
In principle, this technology can be used to detect malicious programs that are as yet unknown, which is why many antivirus software developers were quick to advertise proactive methods as a panacea for the rising wave of new malware. However, this is not the case. To judge the effectiveness of the proactive approach and whether it can be used independently from signature-based methods, one must understand the principles upon which proactive technologies are based. }0ilOABDg
sA["[
There are several approaches which provide proactive protection. We will look at the two which are the most popular: heuristic analyzers and behavior blockers. m?vuSvpB
LX+cZ
Heuristic Analysis ~,)o{M/
A heuristic analyzer (or simply, a heuristic) is a program that analyzes the code of an object and uses indirect methods of determining whether it is malicious. Unlike the signature-based method, a heuristic can detect both known and unknown viruses (i.e., those created later than the heuristic). %60`3&%s
6fSqLm%9@
An analyzer usually begins by scanning the code for suspicious attributes (commands) characteristic of malicious programs. This method is called static analysis. For example, many malicious programs search for executable programs, open the files found and modify them. A heuristic examines an application’s code and increases its “suspiciousness counter” for that application if it encounters a suspicious command. If the value of the counter after examining the entire code of the application exceeds a predefined threshold, the object is considered suspicious. 2A6L]hj"
u`T|^x&F
The advantages of this method include ease of implementation and high performance. However, the detection rate for new malicious code is low, while the false positive rate is high. SZT; jR|!+
/@P9|c kt
Thus, in today’s antivirus programs, static analysis is used in combination with dynamic analysis. The idea behind this combined approach is to emulate the execution of an application in a secure virtual environment (which is also called an emulation buffer or “sandbox”) before it actually runs on a user’s computer. In their marketing materials, vendors also use another term - “virtual PC emulation”. \ABvrKb}
~~ Sm 7^
A dynamic heuristic analyzer copies part of an application’s code into the emulation buffer of the antivirus program and uses special “tricks” to emulate its execution. If any suspicious actions are detected during this “quasi-execution”, the object is considered malicious and its execution on the computer is blocked. zr%?@` 9
: ^(X
The dynamic method requires significantly more system resources than the static method, because analysis based on this method involves using a protected virtual environment, with execution of applications on the computer delayed according to the amount of time required to complete the analysis. At the same time, the dynamic method offers much higher malware detection rates than the static method, with much lower false positive rates. D'sl,iZ?<
u[3U8Fy
The first heuristic analyzers became available in antivirus products sufficiently long ago, and all antivirus solutions now take advantage of more or less advanced heuristics. r`b&lMR
JNw?
W#/
Behavior Blockers Fo |yP&f
A behavior blocker is a program that analyzes the behavior of applications executed and blocks any dangerous activity. Unlike heuristic analyzers, where suspicious actions are tracked in emulation mode (dynamic heuristics), behavior blockers work in real-life conditions. :+.R,I<!
S"'Sf
First-generation behavior blockers were not very sophisticated. Whenever a potentially dangerous action was detected, the user was prompted to allow or block the action. Although this approach worked in many situations, “suspicious” actions were sometimes performed by legitimate programs (including the operating system) and users who didn’t necessarily understand the process were often unable to understand the system’s prompts. J2:8[-%oi(
s-NZKZfF\
New-generation behavior blockers analyze sequences of operations rather than individual actions. This means that determining whether the behavior of applications is dangerous relies on more sophisticated analysis. This helps to significantly reduce the number of situations in which the is prompted by the system and increases the reliability of malware detection.
Hm|B(A
$6&|Dyqi
Today’s behavior blockers are able to monitor a wide range of events in the system. Their primary purpose is to control dangerous activity – that is, analyze the behavior of all processes running in the system and save information about all changes made to the file system and the registry. If an application performs dangerous actions, the user is alerted that the process is dangerous. The blocker can also intercept any attempts to inject code into other processes. Moreover, blockers can detect rootkits - i.e., programs that conceal the access of malicious code to files, folders and registry keys, as well as make programs, system services, drivers and network connections invisible to the user. %@9T.$g8
Dz1zHq_<h
Another feature of behavior blockers that is particularly worth mentioning is their ability to control the integrity of applications and the Microsoft Windows system registry. In the latter case, a blocker monitors changes made to registry keys and can be used to define access rules to them for different applications. This makes it possible to roll back changes after detecting dangerous activity in the system in order to recover the system and return it to its state before infection, even after unknown programs have performed malicious activity. ?0I?Y$D
6"Po{^y;
Unlike heuristics, which are used in nearly all contemporary antivirus programs, behavior blockers are much less common. One example of an effective new-generation behavior blocker is the Proactive Defence Module included in Kaspersky Lab products. NT'|3Y| l
g89v^)Vl
The module includes all of the features mentioned above and also, importantly, a convenient system that informs the user of the dangers associated with any suspicious actions detected. Any behavior blocker requires input from the user at some point; so the user must be sufficiently competent. In practice, users often do not have the knowledge required, and information support (in effect, decision-making support) is an essential part of any contemporary antivirus solution. ciY`wbs
gs&&9K
To summarize, a behavior blocker can prevent both known and unknown (i.e., written after the blocker was developed) viruses from spreading, which is an undisputed advantage of this approach to protection. On the other hand, even the latest generation of behavior blockers has an important shortcoming: actions of some legitimate programs can be identified as suspicious. Furthermore, user input is required for a final verdict regarding whether an application is malicious, which means that the user needs to be sufficiently knowledgeable. RNPD FkMB&
 h&fX-f
Proactive Protection & Software Flaws 5`3WB~=d,
Some antivirus vendors include statements in their advertising and marketing materials that proactive/heuristic protection is a panacea for new threats, which does not require updating and therefore is always ready to block attacks, even for those viruses that do not as yet exist. Moreover, brochures and datasheets often apply this not only to threats that use known vulnerabilities, but to so-called “zero-day” exploits as well. In other words, according to these vendors, their proactive technologies are capable of blocking even malicious code which uses unknown flaws in applications (those for which patches are not yet available). 3m&MHX
AMP.d G@Ga
Unfortunately, either the authors of these materials are insincere or they don’t quite understand the technology well enough. Specifically, combating malicious code is described as a fight between virus writers and automatic methods (proactive/heuristic). In reality, the fight is between people - virus writers versus antivirus experts. i`Fx@x1
N? ~]PU8
The proactive protection methods described above (heuristics and behavior blockers) are based on “knowledge” about suspicious actions characteristic of malicious programs. However, this “knowledge” (i.e., a set of behavior-related rules) is input into the program by antivirus experts and is obtained by analyzing the behavior of known viruses. Thus, proactive technologies are powerless against malicious code that uses completely new methods for penetrating and infecting computer systems, which appeared after the rules were developed – this is what zero-day threats are all about. Additionally, virus writers work hard to find new ways of evading behavior rules used by existing antivirus systems, which in turn significantly reduces the effectiveness of proactive methods. ]x
b $FM6
&l<rlhi{
Antivirus developers have no choice but to update their set of behavior rules and upgrade their heuristics in response to the emergence of new threats. These types of updates are certainly less frequent than in the case of virus signatures (code templates), but still need to be performed regularly. As the number of new threats increases, the frequency of such updates will inevitably rise as well. As a result, proactive protection will evolve into a variant of the signature method, albeit based on “behavior” rather than code patterns. 09.
=5MYv
}QxKMoU
By concealing the need to update proactive protection from users, some antivirus vendors in effect deceive both their corporate and personal clients and the press. As a result, the public has a somewhat erroneous idea of the capabilities of proactive protection. ?{.Usk1
uAn1z-`
Proactive vs. Signature-Based Methods xd y
=
Despite their shortcomings, proactive methods do detect some threats before the relevant signatures are released. An example of this can be seen in the response of antivirus solutions to a worm called Email-Worm.Win32.Nyxem.e (Nyxem). m`wtz#M
`@nvoi&?
The Nyxem worm (also known as Blackmal, BlackWorm, MyWife, Kama Sutra, Grew and CME-24) can penetrate a computer when a user opens an email attachment containing links to pornographic and erotic sites or a file on open network resources. It takes the virus very little time to delete information on the hard drive. Up to 11 different file formats are affected (including Microsoft Word, Excel, PowerPoint, Access, Adobe Acrobat). The virus overwrites all useful information with a meaningless set of characters. Another distinctive characteristic of Nyxem is that it only becomes active on the third of each month. ZHG1+?My
uA, (tXY
A research group from Magdeburg University (AV-Test.org) carried out an independent study to assess the time it took different developers to respond once Nyxem emerged. It turned out that several antivirus products were able to detect the worm using proactive technologies, i.e. before the signatures were released: oUF&Z$0
,F t'"#^'P
Proactive detection of Nyxem by behavior blockers pc nZ
Kaspersky Internet Security 2006 (Beta 2) DETECTED ~D};vs2y
Internet Security Systems: Proventia-VPS DETECTED WEmiGI
_;/
Panda Software: TruPrevent Personal DETECTED U?k})|sF
j=9qFT?Y
Proactive detection of Nyxem by heuristics w{1>yQ5
eSafe Trojan/Worm [101] (suspicious) /e :w/v%]
Fortinet Suspicious 5c@g @\
McAfee W32/Generic.worm!p2p HK0:*e=S
Nod32 NewHeur_PE (probably unknown virus) (i#:'W3,Vy
Panda Suspicious file BrIxg+8Og
B2cYy,Whi
Time of release of signatures to detect Nyxem \1"ar.@e
BitDefender 2006-01-16 11:13 Win32.Worm.P2P.ABM 6Nz</bHn
Kaspersky Lab 2006-01-16 11:44 Email-Worm.Win32.VB.bi 7 Z2#'Oo#
AntiVir 2006-01-16 13:52 TR/KillAV.GR '$ 6Zv$S
Dr Web 2006-01-16 14:56 Win32.HLLM.Generic.391 ^PE)T\Jd
F-Secure 2006-01-16 15:03 Email-Worm.Win32.VB.bi 86tP} 0
VirusBuster 2006-01-16 15:25 Worm.P2P.VB.CIL h %Oer<
F-Prot 2006-01-16 15:31 W32/Kapser.A@mm (exact) aY/O~<<I
Command 2006-01-16 16:04 W32/Kapser.A@mm (exact) 4mWc
BF
AVG 2006-01-16 16:05 Worm/Generic.FX >[PT=E
Sophos 2006-01-16 16:25 W32/Nyxem-D Y7C\(9s
Trend Micro 2006-01-17 03:16 WORM_GREW.A BV^LfC:
eTrust-VET 2006-01-17 06:39 Win32/Blackmal.F $E00{4
Norman 2006-01-17 07:49 W32/Small.KI @??(1y
`81
ClamAV 2006-01-17 08:47 Worm.VB-8 u_JP)}t3+
Avast! 2006-01-17 15:31 Win32:VB-CD [Wrm] r8_w81,
eTrust-INO 2006-01-17 16:52 Win32/Cabinet!Worm ~Pn"x<0
Symantec 2006-01-17 17:03 W32.Blackmal.E@mm d pI^uj)
Source: Security Watch: Blackworm Blows Up On Friday (PC Mazagine, AV-Test.org) PUl, m`S
i|v4`;i
Overall, eight antivirus products detected Nyxem using proactive methods. Does this, however, mean that proactive technologies can replace the “classical” signature-based approach? Certainly not. To be valid, analysis of the effectiveness of proactive protection should be based on tests involving large virus collections, not individual viruses, however notorious. !_Hh^u4
xYCA#3{C
One of the few widely acknowledged independent researchers who analyze proactive methods used by antivirus products on large virus collections is Andreas Clementi (http://www.av-comparatives.org/). To find out which antivirus programs are capable of detecting threats that do not as yet exist, solutions can be tested on viruses that appeared recently, e.g., within the past three months. Naturally, antivirus programs are run with signature databases released three months ago, so that they are confronted with threats that were then “unknown” to them. Andreas Clementi’s focus is on the results of this type of testing. \jI\;Te
D"7"s/bw7
Based on the results of testing conducted in 2005, the heuristics used in the Eset, Kaspersky Anti-Virus and Bitdefender solutions were the most effective. Kd(Csrrl`
!^-0vTI
The test used a collection that included 8,259 viruses. From the results above, we see that the highest detection rate in the test was about 70%. This means that each of the solutions tested missed at least 2,475 viruses, hardly an insignificant figure. vX2I;SnO
+uEY[>a:V
In another test of the effectiveness of heuristic analyzers conducted by experts from Magdeburg University (AV-Test.org) in March 2006 for PC World magazine, detection rates achieved by leaders of the test did not exceed 60%. Testing was conducted using one-month old and two-month old signatures. 2=+\1x`
XY>W 6
It should be noted that the high detection rates demonstrated by heuristic analyzers have a downside: their false positive rates are also very high. To operate normally, an antivirus program should strike a balance between detection rates and false positive rates. This is also true of behavior blockers. TO4jO1 C
e &n}Yi
The results of the analyses conducted by AV-comparatives.org and AV-Test.org provide a solid illustration of the fact that proactive methods alone are incapable of providing the necessary detection rates. Antivirus vendors are perfectly aware of this and, for all their rhetoric on proactive technologies, continue to use classical signature-based detection methods in their solutions. Tellingly, developers of purely proactive solutions (Finjan, StarForce Safe'n'Sec) must purchase licenses for “classical” signature-based technologies from third parties and to use in their products. ? m5A#{
%(0 U'e
Naturally, signature-based methods have shortcomings as well, but so far, the antivirus industry has been unable to come up with anything capable of replacing this classic approach. Consequently, the primary criteria to measure the effectiveness of antivirus solutions will continue to include not only the quality of proactive protection, but response time to new virus threats (the time it takes to add the relevant signature to the database and deliver the update to users) as well. z>`i}jM
= O'rHB!9
Below is information on average response times demonstrated by leading antivirus vendors for major antivirus threats during 2005. The Magdeburg University research group (AV-Test.org) analyzed the time it took developers to release updates containing the relevant signatures. The analysis covered different variants of 16 worms that were most common in 2005, including Bagle, Bobax, Bropia, Fatso, Kelvir, Mydoom, Mytob, Sober and Wurmark. |O{!=r 
P.}YK$vG
Average response time 2005 \ 2U:X}
0 to 2 hours Kaspersky Lab oeG82K]:
2 to 4 hours BitDefender, Dr. Web, F-Secure, Norman, Sophos ;lqW/rGjN
4 to 6 hours AntiVir, Command, Ikarus, Trend Micro sP({:2F*#
6 to 8 hours F-Prot, Panda Software ,t4 fH
8 to 10 hours AVG, Avast, CA eTrust-InocuLAN, McAfee, VirusBuster Z)z<4l ?$
10 to 12 hours Symantec ,Zw+x53Nd
12 to 14 hours — sPGW'@&e#
14 to 16 hours — KiOpy8l+
16 to 18 hours — `mfF8A 0
18 to 20 hours CA eTrust-VET lQWig-`z
Source: Ranking Response Times for Anti-Virus Programs (Andreas Marx of AV-Test.org). X']}D/3d
[c5IFmgc>
Conclusions p&`y }4
In summary, a number of important conclusions can be made from the above. First of all, the proactive approach to combating malicious programs is the antivirus industry’s response to the ever-growing stream of new malware and increasing rates at which it spreads. Existing proactive methods are indeed helpful in combating many new threats, but the idea that proactive technologies can replace regular updates to antivirus protection is a fallacy. In reality, proactive methods require updating as much as signature-based methods. sE"8DN$S
F!gBc +J=
Existing proactive techniques alone can not ensure high malicious program detection rates. Furthermore, higher detection rates are in this case accompanied by higher false positive rates. In this situation, the new threat response time remains a solid measure of antivirus program effectiveness. `
'kcYmeE>
8 =uURMZ*
For optimal antivirus protection, proactive and signature-based methods should be used together, given that top detection rates can be achieved only by combining these two approaches. The figure below shows results of testing conducted by Andreas Clementi (www.av-comparatives.org) to determine the overall (signature-based + heuristic) malicious program detection levels. It may seem that the differences between programs that performed well in tests are small. Yet, it should be kept in mind that the test was performed on a collection of over 240,000 viruses and a difference of 1% accounts for about 2,400 missed viruses. au^hfuxVz
.A)`: k.
Users of antivirus solutions should not place too much trust in the information they find in vendor marketing materials. Independent tests that compare the overall capabilities of products are best suited to assessing the effectiveness of solutions available on the marketplace.

NOD32 的那篇

OK, so I told you I would blog about the Spycar test file – I will, but first you need to understand behavior blocking technology for anything about Spycar to make sense. A,.^J$6
Scanners and behavior blockers both attempt to stop viruses, spyware and other bad programs. The approaches used by scanners and behavior blockers are complimentary when a skilled user applies them. C|#y<(Jj
%i'&zfQu
/j~#J&1
q[ .@&?LX
Traditional anti-virus products offer protection by blocking bad programs from running. There is virtually no level of expertise required by the user, the scanner recognizes a bad program and will not let it run. You might call this an intelligent approach. Good programs run without the scanner bugging you and bad programs are blocked, regardless of whether you are an expert or a novice. h4%:zzv

SAbZ{
8q
Qx IR5XJ
8%ag eS
Behavior blockers do not care what the motive of the program is, they stop certain things from happening. Airport security is a lot like a behavior blocker. It doesn’t matter if a person is the best surgeon in the world, the doctor cannot take a knife onto an airplane. Behavior blockers do not generally care what the program is, if it tries to perform a specific action the behavior blocker will stop it. If the behavior blocker is set to stop programs from writing to the registry then many bad programs will fail to work and many good programs will be completely unusable as well. r?ucv(tLm0
kL q1-To1
q\Y4"p`f
y)(xNspi
If you wish to use a behavior blocker effectively it generally requires that you understand a lot about computers. You have to know when to tell the blocker an action is ok and when to say no. If you say no all of the time you will not be able to use much software. If you say yes all of the time a behavior blocker will not help you and it will probably annoy you so much that you remove it. !TM"aa`
I` &tK-j
iCg2$U`,1
.TXc0KV+
Microsoft Office introduced a behavior blocker in Word 97. The blocker was macro protection. If you turned on macro protection then every time you opened a document that macros it would ask you if you wished to let macros run. If you knew when to choose no and when to choose yes then this behavior blocker could very effectively protect you against macro viruses. Most people just clicked yes and so the behavior blocker was mostly ineffective 7/RMOFS
l_n{C 3
Sd!)f8(C
3xr  ^*,G
Is a behavior blocker right for you? It depends on how much you know and what your tolerance is for interruption. If you know what it means to write to the hosts file, the start menu, HKCU run, HKLM RunOnce, and so on then you may be able to use a behavior blocker effectively. If you do not understand when these actions are or are not ok then a behavior blocker is probably not the right security approach for you. If you try to install a networked printer a good behavior blocker will probably warn you. Will you know that it is your printer installation program that is changing your hosts file, why it is changing it, and if it is ok? Is it ok for a chat program to modify the hosts file? c" =vxW$
LU <w"
x-{bG81
_;C_X3
Spycar does not test products to see how well they detect bad programs, Spycar allows knowledgeable users to test behavior blocking programs to see what actions, they block –regardless of whether the action is good or bad. It is up to you to determine when the behavior is good or bad. \PA:@3 Y?
De h3Ry}
V>|c< \s9
T-l|

Here is a real life scenario for you. Some Internet browser toolbars are ok. Some toolbars install spyware or adware. When you install a toolbar it will make some changes that a good behavior blocker will detect and warn you about. The behavior blocker will not tell you which toolbar is good and which one is bad, only that the toolbar is trying to do something. If you are like most people the if the toolbar with spyware looks like something really cool you will tell the behavior blocker to let you install it and your computer will become infected. If you go to install the good toolbar, but think it might be bad because the behavior blocker told you the program is doing something, you will block it and then be denied the benefits of the good toolbar. ykyAX{\VX
c!st.G A
+M~^kxO8
H}lD~f*V
Behavior blockers are tools that indicate activities, not programs that detect spyware, viruses or anything else – determining whether or not the action is good or bad is your job when you use a behavior blocker.

tracydk

看不懂,都说了什么???

Oceanzd

哈哈，各说各的好，有趣

hzq277284

好长啊
只要卡巴的行为分析大致与NOD32的启发半斤八两，就肯定选卡巴，因为病毒库差距太大

银雕

偶两个都用

pmj_sh

NOD32的病毒库小是过不了VB100%42次的
每次170000的基础测试病毒库
启发式判断结果《行为模式倒是真的

哪吒

倒~
E文撒~~
说实话别看NOD32过VB很多次
我原来用时还是对他比较失望~

起点

也有可能nod对变种的定义和其他厂商不同
例如 仅有微小差别的两个变种他定义的病毒名称相同(纯属瞎猜)
感觉考虑能查出多少个不同的病毒意义比较大
AVG的病毒库够大但是效果还是一般

caglian

不管黑猫白猫 有用的就是好猫

PS:个人倾向行为和启发的中和体

caglian

卡巴的那篇

病毒攻击为龙头,树立自己的安全有威胁.他们不仅造成经济损失,但他们也为许多其他汽车安全威胁如擅自窃取机密资料,并获得敏感资料.防毒业的回应,形成了一批新的办法保护它的基础设施--等等,这些技术包括:主动、紧急更新期间爆发,反病毒数据库更新更趋频繁,本文是第一等的一系列文章,将会提供更多的最新信息技术公司,帮助用户使用防毒判断这些技术的有效性更客观.在这篇文章中,我们将重点放在积极主动的技术.房成6nshc申办? uvpcj病毒攻击造成了巨大的损失,同样重要多少种恶意代码增长速度.2005年,增长多少恶意程式爆炸:据kaspersky实验室平均每月病毒检测达到了6368年底.总体增长幅度达到117%,较上年增长了93%.十大\五时"仍具*8mjx警察局同样威胁的性质本身发生了变化. 恶意程式不仅更为众多、而且明显比以前更加危险. 防毒业的挑战与回应一些新办法防毒保护包括积极主动的技术,缩短反应时间,可导致爆发新的威胁,以及更频繁更新防毒数据库. 这篇文章提供了详细的分析,积极保护商贩往往作为推动所有现有的灵丹妙药,甚至所有可能的病毒. kt7q3bt左旋三月3195元,? C4的3195? 主动数据流技术概论五月二日当代使用两条主要的防毒产品侦测恶意代码签名的主动/启发式分析. 第一种方法相当简单:澳疗程就使用者的电脑比较模板(例如,硫ignatures)已知病毒. 这一新技术是不断跟踪恶意程式,并说明自己的创造,钨脑出血则是包含在数据库中的签名. 因此,氮防毒公司必须有有效的跟踪服务和分析恶意代码(即一ntivirus顾). 评价的主要准则如何有效签字的办法是实行包括新威胁的反应时间,六requency更新和破案率. 3003195西北腊陈春合并症,,%^签名的方法有很多明显的缺点. 主要缺点是响应时间延迟至新的威胁. 凡事总有时差,外观病毒释放其签字. 当代病毒感染百万电脑能力在很短的时间. pr2bep)jw_U6造林\; 二氧化因此,磷roactive/启发式病毒检测方法越来越受欢迎. 积极的态度,并不涉及释放签字. 而笔他分析了反病毒程序法典物体扫描和/或行为的申请,并决定是否启动软件是一种恶意的预定一套规则. 我BV公司群Uq八rf8vbs五原则笔他的技术可以用来侦测恶意程式,仍属未知,钨脑出血就是为什么许多反病毒软件开发商快速主动广告方式灵药新一波上涨恶意. 但是,笔他并非如此. 判断的有效性,以及是否能主动脱离签名用型方法、澳氖必须了解原则赖以主动技术基础.3195 0iloabdg飒["有几个途径提供积极保护. 磷我们将看看这两种最受欢迎:启发式分析和行为阻断.米? 五usvpblx启发式分析的Z~+丙)、澳陈春男/启发式分析器(或者干脆,启发式)是一种分析程式码的间接目的和用途的确定方法是否恶意.不像签名的方式,启发式已知和未知的病毒都能够探测(即那些创造迟启发式).1960年3&'%%%9@收盘6fsq镑的扫描仪通常始于守则可疑属性特征 (指挥)恶意程式.这种方法被称为静态分析.例如,许多恶意程式搜索可执行程序,公开的档案,发现和修改.启发式审查申请的代码,增加了"多疑柜",若遇到可疑申请司令部.如果商品柜检查后,整个实务应用超过预定阈被视为可疑对象.2a6l]萨克尔"美`笔|立方公尺及F×这种方法的优点包括:便于执行和高性能. 但是破案率低是新恶意代码,而假阳性率很高. 第二步;两人|! +/P9的@|三裘因此,在今天的防毒程式,静态分析与动态分析相结合使用. 其背后的理念结合的办法就是仿效申请执行在一个安全的虚拟环境(也是一个叫缓冲或竞赛"砂"),然后在实际经营使用者的电脑. 在营销材料商贩还使用了另一个词"电脑虚拟仿真". \~~钐七月abvrkb3195平方公尺动态启发式分析器部分副本申请代码为缓冲区的防毒方案竞赛和特殊用途的"绝活"学习其处决. 如果这期间发现任何可疑行动"准执行"对象是恶意的计算机及其执行受阻. 锆成? @'9:^(×需要更多的动态方法比静态法系统资源,因为这种分析方法是采用基于保护虚拟环境在计算机应用与执行延迟根据所需的时间内完成分析. 在此同时,动态方式提供更高恶意破案率比静态法假阳性率较低. 云收盘公升、3,4? "美国〔3u八月风云第一启发式分析器成了足以提供防毒产品早已防毒解决方案,并正利用一切或多或少先进启发式. 住宅及L'二米住宅jnw? -#/行为阻断佛|永平及F阻滞剂行为是应用程式的执行情况,并分析了行为危险砖任何活动. 不同于启发式分析器、凡在竞赛跟踪可疑行为模式(动态启发式)行为阻断工作生活中的实际状况. :+. 住宅,我"! 收盘:"'美国F第一代阻滞剂行为不很成熟. 每当发现潜在危险的行动,用户被允许或阻止促使行动. 这种方法虽然在许多情况下,"可疑"行动是合法的,有时表演节目(包括操作系统)和用户不一定了解过程往往无法理解系统的提示. J2项:8[-零爱(硫nzkzff\新一代作战序列分析阻滞剂行为而非个人行为. 这意味着确定的行为是危险的依赖更先进的应用分析. 这有助于大幅减少的情况下,促成了制度、增加了可靠性检测恶意程序. 皇家|乙(600&|镝琪今天的行为能够阻断一系列事件监测系统. 其主要目的是为了控制危险作业即分析行为的全过程管理信息系统,并节省约全部修改档案和档案制度. 如果申请演出危险动作,用户管理员,过程十分危险. 还可以拦截任何企图阻断了注入代码到其他进程. 此外,阻滞剂能检测rootkits-即节目码为恶意隐瞒准入档案档案夹、钥匙,以及做节目,系统服务司机和无形的网络连接用户. 9t@%. 八国集团元dz1zhq_"八行为阻断另一个特点是特别值得一提的是,他们有能力控制的完整性和微软视窗系统注册申请. 就后者而言,一阻滞剂显示器改动注册钥匙,可以用来确定不同的准入规则向他们申请. 这使得侦查危险击退活性变化后的制度,以弥补国有制,并交回其前感染节目演出后未知恶意行为. ? 0i上? 丁元肽Y6"宝陈春立方公尺肽Y; 不同于启发式、所使用的几乎所有当代防毒程式,更常见的行为阻滞剂. 例如一个有效的新一代是积极的防卫行为阻断模块列入kaspersky实验室产品. 新台币'|3y|左旋g89v平方公尺)链模块包含所有的上述特点,重要一个方便用户的系统,通知危险发现任何可疑行动. 任何需要投入行为阻断用户在某一点;所以使用者必须充分胜任. 在实践中,用户往往不具备所需的知识、信息支持(实际上决策支持)是当代任何一个重要部分防毒解决方案. ciy科技与政`分解刑事诉讼总结既可以防止行为阻断已知和未知(即阻断后写研制)病毒蔓延,这是一个不争的优势,以这种方式保护. 在另一方面,甚至最新一代性能阻滞剂具有重要缺点:一些合法的行动纲领,可以认定为可疑. 此外,用户输入所需的最终裁定是否恶意申请,这意味着用户需要够知识化. rnpdfkmb&八&盘氟积极保护和软件缺陷五月`3wb~=四、一些商贩把防毒报表,其广告和推销材料主动/启发式保护是万能的新威胁,钨脑出血并不需要更新,因此总是愿意块攻击,五做为那些尚没有病毒存在. 此外,二这时候数据表、申请rochures不仅威胁使用已知脆弱性,二超声波以所谓"零天"功勋等. 换句话说,根据这些商贩,笔继承人主动技术能力阻止甚至恶意代码利用未知漏洞申请(其中大棚那些尚未得知). 122克及mhxamp.d@镓不幸权证这些材料的作者笔俩还是不太了解技术方面做得不够好. 具体来说,三ombating恶意代码病毒称为搏斗作家和自动方式(主动/启发式). 实际上,笔他是人与人之间斗争病毒作者与反病毒专家. 我`盘@x1氮? ~]pu8积极保护上述方法(启发式、行为阻滞剂)是基于"知识"的可疑行为特征恶意程式. 但是,笔他的"知识"(即一一套行为有关的规则)输入程序,并获得了防毒专家分析已知病毒行为. 因此,公关oactive技术无能为力恶意代码,利用全新的方法穿透,感染计算机系统,筹募规则制定后出现出血--这就是零三天威胁是一回事. 此外,六俄罗斯作家努力寻找新途径逃避行为规则用现有防毒系统,筹募出血进而积极有效的方法大幅度降低. ×元乙fm6及L"rl喜陈春防毒商不得不更新自己的一套行为规则,提升自己启发式针对出现的新威胁. 这些类型的更新肯定较频繁的情况比病毒签名(模板代码),卜笔仍需定期演出. 随着一批新的威胁增加,次更新频率等电子必然会增加. 由于公关oactive将演变为保护签名法的变种,铝贝特基于"行为"而不是法典模式. 09. =5myv3195qxk牟隐瞒需要更新主动保护使用者,因此防毒厂商都在欺骗我自己效力,公司和个人客户和新闻界. 由于次电子大众有所误区主动防护能力. ? 陈春. usk1uan1z-`主动与签名的方法XD对肽Y=虽然缺点,公关oactive威胁方法做一些前查看有关签名的等级. 这个例子可以看出,在反应称为电子邮件防毒解决了蠕虫-worm.win32.nyxem.e(nyxem). #TZ细胞钨米`米`@&nvo我? nyxem的蠕虫(又名blackmal、基本法ackworm,mywife,卡马佛经,躺着乳剂和医学-24)当一个用户的计算机可以穿透启用电子邮件联系实习含有淫秽、色情网站或一个档案开放网络资源. 需病毒很少时间删除硬盘数据. 多达11个不同的档案格式影响(包括微软Word、恩细胞、PowerPoint中,进入专杂技的OBE). 病毒overwrites各种有用信息以无意义字符集. 另一个特点是,它仅nyxem活跃于每月第三. zhg1+? 美一发布会(笔马格德堡大学的一个研究小组从XY条(影音-test.org)进行独立研究,以评估不同发展时期代为回应nyxem一旦出现. 原来这几个防毒产品能主动侦测蠕虫利用技术,导e.签字之前获得释放:乌与0元的Z、六笔'"#^'磷的主动侦查行为阻滞剂nyxem筹委会纽币 kaspersky互联网安全2006(β2)发现3195~四; vs2肽Y互联网安全系统:公关oventia-车辆定位--wemigi侦破; /熊猫软件:图腾美发现uprevent个人? 钾3195)|=9qft十轮? 肽Y主动侦查的启发式-陈春一月nyxem"肽Y问五esafe木马/蠕虫[101](可疑)/电子:-/五成〕fortinet可疑5C号@政@\飞 w32/generic.worm! P2P的hk0:*电子nod32newheur_pe收盘=(可能未知病毒)(一#:'在W3,VY状熊猫可疑文件星光8端口燥b2cy美意盔发布时间签名查看nyxem\1"钢筋一室bitdefender@2006年1月16日11时13win32.worm.p2p.abm6nz"/二HN蛋白 kaspersky实验室2006年1月16日11时44分电邮worm.win32.vb.bi七月的Z2-#'#antivir对象2006年1月 16日13时52分意境/killav.gr'小松五元港币收盘何win32.hllm.generic.391立方公尺体育网2006年1月16日14 时56分)笔\约旦第纳尔架稳妥电子邮件2006年1月16日15时03-86年总磷 worm.win32.vb.bivirusbuster319502006年1月16日15时25小时零worm.p2p.vb.cil高清"歼端口 w32/kapser.a@2006年1月16日15时31毫米(确实)是/澳~"2006年1月16日16时04<i指挥 w32/kapser.a@mm(exact)4mwc4752006年1月16日16时05分高炉worm/generic.fx=权证"[铂 Sophos据2006年1月16日16时25w32/nyxem-dy7c\(2006年1月17日3时169s趋势科技worm_grew.a乙丙五立方公尺低频:权证信托审核2006年1月17日6时39win32/blackmal.fe00陈春元2006年1月17日7时 49w32/small.ki@四月诺曼? ? (2006年1月17日8时47worm.vbclamav114-1`1981年8u_jp)3195+的T3avast! 2006年1月17日15时31Win32的:VB中镉[水泥]r8_w81、电子信托吸入win32/cabinet2006年1月17日16时52 分! ~蠕虫通知书"×"赛门铁克2006年1月17日17时030毫米丁丕立方公尺︱w32.blackmal.e@)消息:安全监视:基本法ackworm 就击出周五(筹委会mazagine、房室-test.org)普勒,收盘米`我|四月`五; 我总体工程师67nyxem用主动防毒产品检测手段. 然而,这我一项技术,可以主动代替"经典"签名的方式? 当然不是. 为有效,分析中的有效性应以积极保护病毒测试涉及大量收藏,而不是个别病毒泰陈鸿臭名昭著. ! ^黄海_hh十大yca#3陈春三是少数研究人员分析,积极广泛承认的独立的反病毒产品使用的方法是大型病毒收藏安德烈亚斯金文(http: //www.av-comparatives.org/). 究竟哪个防毒程式可以探测到威胁的存在,但不为,让克分子可考,最近出现的病毒,例如,在过去的3个月. 当然,一个tivirus节目办签名数据库与3个月前公布,以便他们当时都面临着威胁"未知"的. 安德烈亚斯金文的重点是这类测试的结果. \吉\; 德丁"7"s/bw7根据结果进行测试2005年采用启发式的分野,kaspersky抗病毒最有效的解决办法,并bitdefender. 第纳尔(责任rl'! ^-0vti用来收藏测试包括8259病毒. 从以上结果,我们收盘夷,在测试最高破案率约为70%. 这意味着每年至少有2475解错过测试病毒,打然少. VX毒剂2I条; 锡+uey["答:在另一个考验五成效进行启发式分析专家马格德堡大学(影音-test.org)2006年3月在PC世界杂志检测分类号率达到考验领导人不超过60%. 进行测试用一个月的旧两个月大签名. 2=+\`XY条1x的"-6应当指出,高破案率启发式分析显示有坏处:群的住宅假阳性率也很高. 正常运作,一ntivirus节目应该平衡假阳性率和破案率. 阻断行为也是如此. to4jo1三E及氮3195易结果进行分析的AV-comparatives.org及影音-test.org提供了坚实的事实说明,仅方法无法主动提供必要的破案率. 防毒厂商完全知道这件事,并为所有关于积极修辞技术,继续使用签名经典型检测方法的解决办法. 其底蕴,在发展lopers纯主动解(finjan星safe'n'sec队)必须购买许可证"经典"签名的技术和第三方使用其产品. ? 在M5#陈春一厘(0美『E自然迹象的特征为基础的方法有其缺点,但到目前为止,防毒业一直无法想出什么办法可以代替这个经典. 因此,初级衡量成效防毒解决方案将继续积极不仅包括质量保障,但针对新病毒威胁的时候(时间需补充相关资料,并签署了向用户提供最新)等. 的Z"`我3195米=十o'r血红蛋白! 9段平均反应是信息时代领先防毒厂商主要表现在2005年反病毒威胁. 马格德堡大学的研究小组(影音-test.org)花时间分析最新发布含有有关地产签名. 涵盖16个不同的变异分析中最常见的蠕虫在2005年452封装磺酸,bobax,bropia,胖子,kelvir,mydoom,mytob, sobeR和wurmark. |澳陈春! =住宅磷,3195 2005年-0.4%的平均时间为诉G\二月美国:3195×20小时kaspersky实验室oeg8组分]:2笔澳4小时bitdefender博士网架安全、诺曼、Sophos据; lqw/住宅gjn4-6小时antivir、指挥、ikarus、涂料微丁力(陈春:113*#6至8小时架端口、熊猫软件、跳频4月8日至10笔 475小时,avast、电子核证信托inoculan、津、病毒sbuster的Z)的Z"4月1? 赛门铁克10元至12小时,1912年至1914年的Z-+x53nd小时spgw'@#14至16小时的急症-+转帐py8l16至18小时-`碳粒 8A条018至20小时etrust证-审核lqwig-`的Z来源:级荷兰反应时间防毒程式(马克思房室安德烈亚斯-test.org). ×']}d/3d[碳五ifmgc"结论磷肽Y&'}4总之,一女性质密切重要的结论可以从以上. 首先,主动打击恶意程式的防毒业的回应日益增长流率、增加新的恶意传播. 现有积极防治方法的确有助于许多新的威胁,但树立积极的技术可以取代定期更新防毒保护是谬论. 实际上,PROA的更新办法规定的猪瘟高达签字的方法. 硒"美国F8dn元! 公元前七十+主动=现有技术不足以确保高破案率恶意程序. 再者,高二是在本案破案率陪同假阳性率较高. 在这种情况下,新威胁的反应时间仍是衡量防毒方案扎实成效. ''kcymee"=八月支原体rmz*最佳防毒保护,PROA的深挖和签名的方法应一并使用,让氮检出率最高,可以实现,只有把两者结合的办法. 下面的数字显示测试结果进行安德烈亚斯金文(www.av-comparatives.org)确定总体(签字为本+启发式)恶意程序检测水平. 似乎分歧节目表现出色的测试小. 然而,收盘滑坡的考验,牢记术藏书超过240,000病毒相差1%约占2400错过病毒. ^hfux凹端. )`:钾.用户防毒解决方案不应过分信任他们找到的信息在卖方营销材料. 独立测试,整体性能比较适合的产品解决方案的成效进行评估,可在市场上. 熔点"


NOD32 的那篇

那好,让我告诉你,我对博客spycar测试文件我会但你必须先了解什么行为阻断技术使spycar感.一、. 十立方公尺600阻滞剂扫描器和行为都试图阻止病毒、间谍程式等不良节目.扫描器的使用方法及行为阻断技术是相辅相成当一个用户适用.三|#肽Y"(我皮涅罗成'&zfqu/J和十一月问~#[. @&? lx传统的反病毒产品提供保护阻止不良节目入选. 毫无所需的专业水平的用户,扫描器坏了确认程序,不会让它逃. 你可能把这种智能方式. 好的节目来说,无不良节目扫描器监听你要买不论你是一位专家还是一名新手. 八4%:ZZ诉审计局的Z陈春8q的十大问ir5xj8%银五行为阻滞剂不在乎计画的动机,他们阻止某些事情的发生. 机场安全的行为,是一种阻断了不少像. 不管一个人在世界上是最好的外科医生,医生不能把刀上飞机. 阻断行为并不普遍关心什么节目,如果试图演出一个具体行动阻断行为将停止. 如果行为阻断定停止写程式的档案当时许多不良节目会失灵,许多好的节目将完全无法使用等. 住宅? 茱莉(马来西亚tlm0季-to1问\="'六磷肽Y)(×如果你想用一个包含行为有效阻断它通常需要你们了解了很多关于电脑. 你要知道,当一个行动告诉阻滞剂大碍,何时说不. 如果你说你没有任何时候将无法使用很多软件. 如果你说的话所有的时间不会帮你的行为阻滞剂它可能会激怒你,你这么清除. ! 备忘录"机管局`我`电报钾十元吴素`二月一日. 微软推出办公txc0kv+行为阻滞剂字97. 被阻断的宏观保护. 如果你把你每一次宏观保护然后打开宏文件,它会问你,如果你愿意让宏逃. 如果你不知道当选择这个时候,选择好的话可以非常有效地保护您的行为阻滞剂对宏病毒. 大多数人只是拨动不错,所以大多无效行为阻断7/rmofsl_氮陈春三月三处!) 弯月(三3xr^*,G是一种行为阻断权吗? 你知道它多少取决于你的宽容是什么中断. 如果你知道这是什么意思写信给主机档案,开始菜单,hkcu来说hklmrunonce,等等然后你可以用一个有效阻断行为. 如果你不知道,当这些行动是或不是那么好了,恐怕不是正确的行为阻断方法为你安全. 如果你再安装网络打印机的好行为可能会阻断警告你. 你知道它是你的就是把你的打印机安装程序主机档案所以它是不能改变,而如果是好? 这是一个不错的聊天节目主持人档案更改? 三"的VX-=元禄"-"X光陈春bg81--; c_×3spycar不试制品,看看它们探测不良节目允许用户测试spycar知识化行为阻断节目看到什么行动他们逐户不论是好是坏行动. 这是你们自己决定何时该行为是好还是坏. \坝:@三月肽Y? 3195三月定量五德八"|丙"\•笔左旋|今天是你的真实生活情景. 一些因特网浏览器工具栏就好. 有些工具栏安装间谍程式或间谍. 当你安装一个工具它会使一些变化,一个好的行为阻断你会发现并警告. 阻断行为不会告诉你这是好的,哪一个工具是坏,唯一工具,试图有所作为. 如果你最喜欢的人,如果真像间谍工具与清凉会告诉你,让你的行为阻断它和你的电脑安装成为感染. 如果你到安装好的工具,但想可能是因为不良行为阻断告诉你节目做的,你会阻止它,然后得到好处的好工具. 杨俊钦斧头陈春\VX的三! 先天的+收盘kxo8八立方公尺米~3195公升四~六*五行为阻断工具,显示活动不兼容检测间谍、病毒或是别的-确定是否行动是好是坏,是你的责任,当你用行为阻断.