Among the famous AVs,which is the best in heuristic detection?

Such as NOD32,VBA32,McAfee,BD,etc.

By the way,I'm a student interested in heuristic detection technology

Does anybody have the same hobby?

 

HI, check out the

http://www.av-comparatives.org/ proactive tests on that website its very reliable

lodore

 

haha,i considered "test" as a only reference but not the key evidence
Can you agree with me

 

Yes, i do.

 

Nod and Antivir are both pretty close I would think. But would have to give the nudge to Nod.

 

So you are?but i am just a newbie,Would you mind teach me somthing?

 

Does anybody know some details about it

I mean,Maybe we can conclude it from some "tests",but,obviously,code details are more important

 

haha,recently, i am dealing with it as my school work,but,
there are 2 problems mostly
1 is how to realize a virtual environment in order to simulate CPU instructions?

2 is how to make sure of heuristic rules?

 

I tried to seeking for it from google,but i found few information

 

Take a look to the Bochs project, open source IA-32 emulator.
http://bochs.sourceforge.net/

Mario.

 

Is it becoming to AV function?
Let me see...

 

How to carry it out in AV environment ?

 

1. it's not a so-easy question to answer. There are still a lot of debate about heuristic and how to implement it. Companies follow different ways to implement heuristic: starting from "simple" (relative) static analysis, emulating only based instructions, emulating a full pc, don't emulate nothing and hooking some well choosed Windows API and then evaluate which one are called and how they are called (obviously, this isn't a complete list, there are lots of different techniques to implement heuristic). You just need to evaluate which one better adapt to your needs.
Follow Mario_l hint: you can see how a full pc is fully emulated so you can understand a lot of things from it. Ah, a hint from me: don't start looking for antivirus heuristic source codes, start from the beginning trying to understand every little part of techniques used. Only through this way you are able to choose cleverly which one is what you need and how to better implement it.

2. Obviously there isn't a correct way, every company follow different ways. In fact every heuristic is different from a product to another one. The good heuristic rule is the one that you think, after lot of testing, can identify a malware without false positive (or small percentage of FPs)

Best regards

Marco

 

NOD323, AntiVir and BitDefender. Can't say much for F-Prot but so far it looks promising.

 

Did they (Eset) finally release a new version?

 

Also Norman SandBox is very good.

Regards
joter

 

My impression is that NOD32,Dr.Web,Vba32, and AntiVir have the better heuristics.

 

NOD32 & DrWeb are my favorites...Well at least when it comes to advanced detection.


tD

 

I know AVG and Avast! use a lot of generic signatures, but do either of them actually have a heuristic engine?

Regards

 

They could really have better performances on unpackers with their sandbox

However, Norman Sandbox is a clear example of a fully emulated pc

 

NOD32 and BitDefender have the best heuristics. AVIRA and Dr.Web have about equally as good heuristics but these programs are known to generate more false positives than NOD32 and BitDefender.

F-Prot 4.0 + Maximus also looks extremely promising.

 

I have an interest in heuristics; although, my interests lie in the more mathematical foundations of heuristics, as opposed to the more practical applications in this field.

Dave
The guy who got Dana Scott and Robin Gandy to join the very short-lived Balkan Logical Society

 

Thanks loads

First,what you said did correct lots of my misunderstandings before,thank you ;

and then,as you mentioned ,"every company follow different ways",can you tell details of the venders?

 

I think VBA32 should be added in best heuristic detection camp