Paper: How good are malware detectors at remediating infected systems? (July 2009)

MrBrian · Nov 8, 2011

From the paper:

In this paper we presented an automated testing methodology to assess the completeness of remediation procedures used by malware detector to clean up compromised systems. We used this methodology to test six of the most rated malware detectors on the market and found out that the dangerous effects of an infection are seldom completely removed.
Click to expand...

The transitions are separated in two groups, according to their security impact on the system: primary and ancillary. Primary transitions are those that have a high impact on the system, while ancillary transitions have a minor impact.
Click to expand...

None of the tested malware detectors turned out to be complete, even if only primary transitions are taken into account: about 75% of the total primary transitions and only 4% of the total ancillary transitions were reverted.
Click to expand...

Paper: hxxp://security.dsi.unimi.it/~ema/dimva09.pdf
Slides: hxxp://security.dsi.unimi.it/~ema/dimva09-slides.pdf
WUSSTrace documentation and source code

elapsed · Nov 8, 2011

2 years is an extremely long time in the tech industry.

MrBrian · Nov 8, 2011

There is a newer paper from mid-2010 that contains similar material - Automatic Generation of Remediation Procedures for Malware Infections (hxxp://security.dsi.unimi.it/~ema/usenix10.pdf). Figure 7 shows remediation stats for three anti-malware programs.

wat0114 · Nov 8, 2011

Conclusions
Malware detectors are essential components for preserving the security of com-
puter systems. They allow to detect and prevent malicious software and, when
malware cannot be stopped from infecting a system, they allow to recover from
the infection.
Click to expand...

Essential? No, more like antiquated. As for prevention and recovery, they are less than ideal, to say the least.

[...] We used this methodology to test six of the
most rated malware detectors on the market and found out that the dangerous
eﬀects of an infection are seldom completely removed.
Click to expand...

Hopefully no one's surprised by this revelation

dw426 · Nov 8, 2011

I'm not surprised. Anti-malware and even AV programs are either good at prevention or good at cleanup...and most are excellent at neither. Cleanup has always been an issue, whether it's registry keys, executables or even still running malware left behind.

Log in or Sign up

Paper: How good are malware detectors at remediating infected systems? (July 2009)

MrBrian Registered Member

elapsed Registered Member

MrBrian Registered Member

wat0114 Guest

dw426 Registered Member

Log in or Sign up

Paper: How good are malware detectors at remediating infected systems? (July 2009)

MrBrian Registered Member

elapsed Registered Member

MrBrian Registered Member

wat0114 Guest

dw426 Registered Member

Useful Searches