Symantec SONAR

Sonar, for Symantec Online Network for Advanced Response, is based on technology acquired in the 2005 purchase of WholeSecurity, a maker of anti-phishing and intrusion prevention software. "It's a new behavioral technology," says Ed Kim, director of product management in Symantec's consumer product group. "It's a zero-day defense that doesn't use signatures."

...

Signature-based defenses, however, operate in real-time to block exploits as they try to make their way onto a system. Symantec's Sonar, by comparison, is a scanner, similar to the one that sniffs for viruses and worms, that runs daily. "It's not part of the real-time defense," admits Kim. "Scans run on a daily basis, so this is an extra layer on daily [anti-virus] scans."

http://www.informationweek.com/story/showArticle.jhtml?articleID=196901549

 

Sounds good. Sounds like the emulator in Kaspersky v7

 

I already know about it, but how doas it works?

 

its already old news. I simply wanted to point out that it contradicts a lot of people who take it as an HTTP scanner or a real-time API call monitoring agent.

 

actually.... symantec themselves label it as an 'http scanner' as screenshots shown by BIGC prove.

 

I dunno if this really helps much.

http://www.symantec.com/about/news/release/article.jsp?prid=20070117_01

 

From PC World's NAV review:

SONAR in action:

http://www.symantec.com/home_homeoffice/blog/detail.jsp?blogid=sonar&profileid=laura_garcia-manrique

(thanks to whoever has this link in their sig, can't remember who right now)

 

i looked on that link and cant see it in action.
i assome by see it in action you mean a video of some kind and not some text to read.
lodore

 

Well,
Who do we believe ??

Self publicising by Symantec (not that there is a reason to disbelieve them)
OR
some database of uncertain genealogy and bonafides
(which has never been shown to be wrong by anybody....)

http://winnow.oitc.com/avreadme.html

Disclaimer: I have NAV and Sonar: I hope it's working

 

seen it... Link

 

ha, if you really believe norton to be the worst out of those 20 for engines/detection or whatever, you really need your head seeing to, i dont focus this message on any single person, but to EVERYONE.

i would put the current norton in my top 3 easily, but not telling where

 

that test above is BS
panda above kaspersky atm no way in helll.
panda's detection is improving but no way its better than kaspersky.
lodore

 

I put this up before: from OITC:

 

Pfffffffffffffffffft

 

@C.S.J

Yeah I've seen the screenshot which I assume was from PC World website not Symantec manual or something. Of course I might be wrong but its simply the same thing which was written there in PC World.

Even if it was from Symantec manual or something then also there is a conflict. If Ed Kim is right (or properly quoted) then how come SONAR is not a part of the real-time defense? Is that a technical possibility?

 

From the 'Help' section of NAV 2007:
Turn on SONAR (Symantec Online Network for Advanced Response)
Turn on proactive detection to stop security risks before they reach your computer.

I would say this pretty much means 'Real-time' protection.

 

It is behavior analyser, it can stop threat in real time, but usually it only report and stop evident activity by rule, so there is little chance to see warnning message from sonar, but also it record and sent feeback to symantec all the activities, so they change the rule and the definition to combat the malware.
So, zero-day protection for sonar means some activities violate the rule and the packed file recognized by definition file contribute to sonar data statistic

 

By the way, the rule is not like kaspersky PDM, one rule will trigger stop or ask action. Usually a serials of action will trigger sonar. It is not sandbox, not hips, I think we can call it activity stactis reaction component

 

So probably Ed Kim was misquoted or he was not properly informed