Glaswegian

New reputation-based antivirus systems are doing a better job of blocking malicious software than did their predecessors.

That's what testing and certification company NSS Labs discovered when it looked at how good antivirus software really is at blocking Web-based attacks.

NSS tested nine antivirus products by installing the software and then directing the PC to a battery of more than 3,000 Web sites that were known to be actively downloading malicious software to PCs. For two products, built by Trend Micro and McAfee, the tests took a look at how much so-called reputation-based malware detection systems really helped block malware. These reputation systems use a variety of techniques to size up a program and get a sense of whether it's trustworthy.

According to NSS President Rick Moy, antivirus products that ship with reputation systems tended to do better in the tests. "Not all AV is the same," he said. "There are huge differences between anti-malware products, and the reputation systems are making a considerable impact."

With Trend Micro Internet Security and McAfee Total Protection, NSS compared how the software did with reputation-based detection turned both on and off. Trend Micro's software improved by 23 percent with the system active; McAfee's improved by 8 percent.

Trend Micro and McAfee were also the two quickest companies to protect customers from new strains of malware, NSS said.

Overall, Trend Micro Internet Security performed best in the NSS tests, catching malware 96.4 percent of the time. The number-two-ranked product, Kaspersky Internet Security, also uses a reputation system, although NSS wasn't able to turn it off to see how much it helped with detection.

These reputation-measuring techniques are supposed to enhance traditional signature-based AV products. With signature detection, the antivirus company simply takes a kind of digital fingerprint of the code and then blocks any other program that has the same signature.

Reputation-based detection has become an important new area for antivirus vendors, as criminals have become expert at jumbling up their malicious software so that digital signatures no longer work. "There's a lot of malware being missed by the security industry because it's being changed for every single visitor," said Carey Nachenberg, a Symantec fellow who created the company's new reputation-based detection system.


http://news.techworld.com/security/3...virus/?olo=rss