Has the end arrived for desktop antivirus?

crazijoe · 04-11-2007, 12:46 PM

Analysts say traditional desktop antivirus, signature-based protection won't protect corporate jewels ---- whitelisting, behavior-blocking technology is the answer.

http://www.networkworld.com/news/200...ead.html?t51hb

Quote:

They say signature-based checking can't keep up with the flood of virus variants manufactured by a criminal underworld that is beating the antivirus vendors at their own game. And they are arguing it's time for companies to adopt newer approaches, such as whitelisting or behavior-blocking, to protect desktops and servers.

**Cellus** · 04-11-2007, 09:20 PM

This has admittedly been an ongoing debate for many many years.

Signature-based and behaviour-based detection truly work well, if you think about it, in complementing each other. Signature-based detection has the benefit of detecting known malware with a high degree of accuracy (low false-positives), but not unknown malware (signature-based heuristics are iffy at best). Behaviour-based detection fills the gap nicely as it uses rules of bad behaviour (and sandboxing) to detect possible new malware, but unfortunately can not say in many cases with a high degree of accuracy. As such it is to your benefit to run both and not just one.

Signature detection on its own has never truly been the holy grail in the corporate environment. Behaviour-based detection, complemented with access control, integrity and/or version control, HIPS, whitelists/blacklists, and disaster recovery have helped significantly in security.

Addendum: This "could" possibly change in the future, however at the moment behaviour-based detection's track record needs to be developed more until it can be used as a full-blown viable replacement. They're not yet smart enough. Vendors have been careful in developing behaviour-based detection because they want to ensure as few false-positives as possible. Due to the extreme diversity of systems utilized around the globe, it is very difficult to develop.

**Kalim** · 04-14-2007, 11:55 AM

I've seen this mentioned time and time again. Although many successful security companies are shifting over to behavior based, it doesn't provide the blown out cover both systems once utilized will. So the best approach is a combination rather than a one over the other, just like in PSU's you have single and multi +12V rail heated debate.

04-11-2007, 09:20 PM	#2 (permalink)
Cellus Moderator Networking Team Join Date: Aug 2006 Location: Canada Posts: 2,664 OS: Windows Vista Business SP1, Windows XP Professional SP3 My System	Re: Has the end arrived for desktop antivirus? This has admittedly been an ongoing debate for many many years. Signature-based and behaviour-based detection truly work well, if you think about it, in complementing each other. Signature-based detection has the benefit of detecting known malware with a high degree of accuracy (low false-positives), but not unknown malware (signature-based heuristics are iffy at best). Behaviour-based detection fills the gap nicely as it uses rules of bad behaviour (and sandboxing) to detect possible new malware, but unfortunately can not say in many cases with a high degree of accuracy. As such it is to your benefit to run both and not just one. Signature detection on its own has never truly been the holy grail in the corporate environment. Behaviour-based detection, complemented with access control, integrity and/or version control, HIPS, whitelists/blacklists, and disaster recovery have helped significantly in security. Addendum: This "could" possibly change in the future, however at the moment behaviour-based detection's track record needs to be developed more until it can be used as a full-blown viable replacement. They're not yet smart enough. Vendors have been careful in developing behaviour-based detection because they want to ensure as few false-positives as possible. Due to the extreme diversity of systems utilized around the globe, it is very difficult to develop. __________________ TSF Networking Team Virus/Trojan/Spyware Removal Help Donate! Last edited by Cellus; 04-11-2007 at 09:30 PM.

04-14-2007, 11:55 AM	#3 (permalink)
Kalim Roaming To Help Join Date: Nov 2006 Posts: 5,642 OS: Many	Re: Has the end arrived for desktop antivirus? I've seen this mentioned time and time again. Although many successful security companies are shifting over to behavior based, it doesn't provide the blown out cover both systems once utilized will. So the best approach is a combination rather than a one over the other, just like in PSU's you have single and multi +12V rail heated debate.