Do AntiVirus Products Detect Bots?

DTD · Dec 2, 2008

[...cut...]
So the conclusion is that AV works better and better on old stuff - by the time something has been out for a couple of months, and is still in use, it's likely that 70-80% of products will detect it (still falling quite short of 100% though).

However, from the analysis of the time data, we know that what's really important is the performance on malware samples that are only a few days old, because the sample is likely to get discarded by the bad guys pretty soon after that. If you look just at the samples that fall in the three day window when I was actually updating samples at VirusTotal, the average detection rate is only 40% of products. The trend in the data breaks sharply downwards on very recent executables. This justifies my claim above that AV is likely to detect a currently used bot binary "less than half" the time.

I actually suspect it's worse than that if I got more precise with my timings. What I really need to do is figure out how to add some scripting on the appliance so that I can automatically look up a new binary on VirusTotal right when we very first capture it. I have a feeling that measured that way, the average VirusTotal score would be even lower
Click to expand...

http://blog.fireeye.com/research/2008/11/does-antivirus-stop-bots.html

DTD · Dec 2, 2008

[...cut...]
Where I totally disagree, is the use of VirusTotal online scanner as the primary tool to check effectiveness of antivirus solutions. VirusTotal is a great and useful service and it can give users some statistics about detection rates, it can't be used as the tool that allow testers to write comparatives and judge antivirus's effectiveness.

Sadly, a number of so-called "independent" comparatives are relying upon VirusTotal results. This can't give a complete overview of security software's efficiency.

Detecting new and emerging threats without signatures is a hot topic that has been widely discussed even during international conferences. Everyone in the security field knows that, as today, plain signature detection is not sufficient. Developing new techniques to prevent and block targeted attacks and new malwares is one of the most important goals of every security vendor. It couldn't be different.
[...cut...]
Click to expand...

http://www.prevx.com/blog/106/Why-using-VirusTotal-for-AV-testing-is-a-bad-idea.html

Log in or Sign up

Do AntiVirus Products Detect Bots?

DTD Registered Member

DTD Registered Member

Log in or Sign up

Do AntiVirus Products Detect Bots?

DTD Registered Member

DTD Registered Member

Useful Searches