Malware 2.0 - Avoiding Detection
Malware developers are trying to avoid detection by overwhelming the AV system making it nearly impossible to keep up with the volume according to 'Malware 2.0' raises its ugly head
PC Tools said that malware variants are now released at "immense rates", driving up sample volumes and making it almost impossible for researchers to keep on top of updates using manual analysis.
These threats are taking advantage of the non-detection sweet spot where they can freely propagate and infect before anti-malware companies can respond.
The same article quotes Fran Howarth, of Hurwitz and Associates who says:
Signature-based detection is dead, be it for antivirus, intrusion detection or any other security measures
It's a pretty harsh assessment. It true, our options include:
1. Using data mining techniques to automatically detect patterns indicative of malware, either in static code or in behavior2. Improve behavior-based detection techniques; but malware writers are already developing techniques to avoid that kind of detection.
3. Use application white lists, in spite of their limitations.
#3 can be implemented in the short term but isn't likely a long term solution.
#1 sounds good in theory but malware writers could move to obfuscation techniques that mask the patterns that are detected.
#2 is basically saying do what we do but do it better.
On second thought, maybe the short term solution is the long term solution.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
