AV-Comparatives tests (2006-Q4)

Discussion in 'other anti-virus software' started by IBK, Oct 13, 2006.

Thread Status:
Not open for further replies.
  1. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    Hi,

    as in the period between today and end of December there will be several new tests (apart the retrospective test with the speed-test and false alarm test) appearing on av-comparatives, opened a new thread in the hope that they can all be discussed in it.
    Just "explore" the site from time to time or wait until someone detects new reports and tells their presence here :p.

    Thanks,
    IBK
     
  2. ASpace

    ASpace Guest


    Thanks !
    Since I first learnt about Av-comparetives I like it so much and I am looking forward to all the tests you make . You are great people making excellent and high-quality tests , real tests/results :thumb:
     
  3. Chubb

    Chubb Registered Member

    Joined:
    Aug 9, 2005
    Posts:
    1,967
    Thanks IBK for the good work!!! :thumb: :thumb:
     
  4. dan_maran

    dan_maran Registered Member

    Joined:
    Aug 30, 2004
    Posts:
    1,053
    Location:
    Stamford, CT
    Yes good work, another non-biased test.

    My main question is why doesn't the WLO distribute these samples to smaller companies, ie. VBA?
    Is it due to the fact they are not on the reporting panel?

    It is nice to see AV-Comp is distributing its self made Wildlist to all involved bvery fair IMO.
     
  5. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    no comment from me
     
    Last edited: Oct 14, 2006
  6. Firefighter

    Firefighter Registered Member

    Joined:
    Oct 28, 2002
    Posts:
    1,670
    Location:
    Finland
    And the list still contained all viruses mentioned in the main list in here.

    http://www.wildlist.org/WildList/200608.htm

    Best regards,
    Firefighter!
     
  7. wawy

    wawy Registered Member

    Joined:
    Feb 17, 2006
    Posts:
    23
    hello ibk/others,

    nice to test soft with version 2007 (specialy for avk -kaspersky/avast!)
     
  8. dan_maran

    dan_maran Registered Member

    Joined:
    Aug 30, 2004
    Posts:
    1,053
    Location:
    Stamford, CT
    That is why I stated it was a good move by AV-Comp. to provide them even if the WLO won't.
     
  9. Firefighter

    Firefighter Registered Member

    Joined:
    Oct 28, 2002
    Posts:
    1,670
    Location:
    Finland
  10. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    Last edited: Oct 14, 2006
  11. rdsu

    rdsu Registered Member

    Joined:
    Jun 28, 2003
    Posts:
    4,456
    Glad to hear that IBK!

    It is always great to read what you, and your team, test... :p
     
  12. Firefighter

    Firefighter Registered Member

    Joined:
    Oct 28, 2002
    Posts:
    1,670
    Location:
    Finland
    Is it possible to "freeze" those av signatures lets say 2 weeks AFTER the tested ItW list month in the future, just to see how fast those av:s actually are to detect the ItW list of viruses?

    Best regards,
    Firefighter!
     
  13. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    yes, it would be possible, it would be like the outbreak tests that av-test.org already does from time to time. As av-test.org has every single update of any time, it is preferable and better that av-test.org does the testing you say (looking how much it takes to add itw malware).
     
  14. dw2108

    dw2108 Registered Member

    Joined:
    Jan 24, 2006
    Posts:
    480
    IBK, do the AV authors ever tell you whether their heuristics are Petri net based, graph based, goal oriented, sub-goal inductive, design based, etc.? If you have the time, please respond. Thanks.

    Dave
     
  15. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    no, and probably never asked :p.
     
  16. dw2108

    dw2108 Registered Member

    Joined:
    Jan 24, 2006
    Posts:
    480
    It would be interesting to know. For example. F-Prot claims neural network heuristics, so do they program in C++ with a sochastic net in mind?

    Dave
     
  17. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    for the tests its not relevant. please try to ask the vendors directly.
     
  18. dw2108

    dw2108 Registered Member

    Joined:
    Jan 24, 2006
    Posts:
    480
    Perhaps it's not relevant as per the test results; however, such knowledge beforehand would explain to the vendor the reason for the number of false positives as well as the test files missed. With respect to feedback to the vendor, it would be relevant to the test.

    Dave
     
  19. Firefighter

    Firefighter Registered Member

    Joined:
    Oct 28, 2002
    Posts:
    1,670
    Location:
    Finland
    :D :D :D

    Best regards,
    Firefighter
     
  20. Tweakie

    Tweakie Registered Member

    Joined:
    Feb 28, 2004
    Posts:
    90
    Location:
    E.U.
    dw2108:

    Somebody that claimed to now how (some) AVs work once told me that they used bayes classifiers and/or sparse markov transducers, but he did not give more details.

    By the way, the algorithm used for classifying the malwares is not by itself sufficient to explain or understand false positives or misses produced by an heuristics engine. It is also necessary to understand on which criteria the classification is based.

    It could for example be a measure of similarity between the sequence of API calls produced by the scanned executable and a set of typical "malware" sequences, it could involve frequency of occurrence of various opcodes/bytes, it could take into account the contents of the IAT, etc.

    I think Daniel Bilar's adressed some of these topics during the Blackhat USA 2006 conference.
     
  21. aluckystar

    aluckystar Registered Member

    Joined:
    May 30, 2006
    Posts:
    66
    Location:
    Paris of the East
    I wonder if TrendMicro's PC-Cillin or some other new AV vendor be in the list ?
     
  22. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    no, is not.
     
  23. dw2108

    dw2108 Registered Member

    Joined:
    Jan 24, 2006
    Posts:
    480
    Thanks, tweakie, it's nice to know that some AVs do run on stochastic nets/automata for their model bases. I wrote some papers on this long ago in: Logic in Quotes, J. Phil. Logic, Vol. 16, No. 1, 1987, and another: Algebraic-Valued Quotational Logics, Communication and Cognition, Vol. 20 No. 4, 1987. I had no idea then that some of my work would be would be applicable in the writing of AV apps!

    Dave
     
    Last edited: Oct 15, 2006
  24. The Hammer

    The Hammer Registered Member

    Joined:
    May 12, 2005
    Posts:
    5,619
    Location:
    Toronto Canada
    One for the Inspector to answer. :D
     
  25. Firefighter

    Firefighter Registered Member

    Joined:
    Oct 28, 2002
    Posts:
    1,670
    Location:
    Finland
    Is it possible to test Fortinet in the future too? At least it was better than McAfee against this year trojans according to this.

    http://www.eweek.com/article2/0,1759,2023127,00.asp?kc=EWRSS03129TX1K0000614

    Best regards,
    Firefighter!
     
Loading...
Thread Status:
Not open for further replies.