ANTI-MALWARE
TECHNOLOGIES

Taking preventive measures has nothing to do with the direct detection of threats, but it can help prevent threats. Common practices include: Using a firewall to allow only authorized network traffic. Restriction of visitable websites through URL filters. Block the receipt of certain file types by email and download. Use of a password policy and authentication systems. Introduction of a whitelist approach so that only predefined programs can be run. Vulnerability Detection, for finding possible attack vectors and closing them with patches. Train users to increase their awareness of security.

Originally, a signature was the description of a single threat using a string (e.g. HASH). The initial antivirus programs compared files against a database of signatures and identified the threat if they matched. However, due to the proliferation of malware and its changing properties, this approach will soon go out of fashion. Nevertheless, signatures are still used in a modified form today. A signature can now describe the consistent properties of an entire malware family and thus address thousands of individual threats at the same time. It also defines the complete characteristics of a threat (which files, registry keys, processes, services are included?) and thus helps with the complete removal. Signatures alone can therefore no longer offer complete protection, but still provide valuable expert knowledge of known threats.

Reputation information can be viewed as a successor to signatures and is not unlike them. In large databases, vendors make risk assessments for a wide variety of objects (files, IP addresses, URLs, …) using statistics, algorithms and other technical facilities. These classifications describe whether a file should be viewed as benign, malicious or at least with caution. This information is helpful when a malicious file does not contain any recognizable malicious code and would therefore be considered benign by other security measures. In this case, the reputation information would help to classify the file correctly. As the sole protective measure, reputation information is just as inadequate as signatures, but can also make a contribution. Reputation data is usually used by vendors in combination with other security measures to reduce, for example, their analysis load.

A “cloud” is understood to mean a vendor’s data centers that are used to provide security approaches. There are good reasons for this: The provision of data (e.g. signatures, reputation data) on demand significantly reduces the amount of data to be transferred. The outsourcing of analysis techniques to a cloud relieves the local endpoints and allows more complex techniques. The collection of data at a central point (Big Data) enables global patterns and relationships to be recognized. Depending on the vendor, different processes are used for cloud communication. A local component collects data and either transfers it to the cloud permanently or only when needed. The transfer can either consist of a HASH value, complete files or even more information. The cloud then sends instructions that are implemented by the local component. Using a cloud has many advantages, but you should pay attention to how much security is still available if the cloud is not accessible.

Heuristics is an analysis technique for files to detect previously unknown threats or mutations of threats. Various techniques can be used for this: Execution in a virtual environment to determine a threat based on the behavior of the file (file emulation). Analysis of the code for typical threat structures or commands such as overwriting files or self-replication (file analysis). Percentage comparison of the source code with known threats to determine family membership (genetic signature detection). This makes heuristics a good and widespread approach. It should be noted that false alarms (false positives) can occur.

The sandbox approach seeks to discover whether something is “good” or “evil” based on its behavior. The file in question is run in a virtual, secure environment. This environment can either be simulated locally or be available in the form of an appliance. During execution, the environment is monitored for changes that could indicate a threat (connection to an Internet address, creation of new files, attempts to encrypt, …). These observations then decide on the classification of the file. Sandboxing is a good way to identify unknown threats. However, it must be noted that this does not work with every file type, only automatic behavior can be recognized and there is a risk of false alarms (false positives).

This approach does not attempt to identify a threat directly, but rather to identify the route by which a device can be infected. Most of these are known vulnerabilities (CVE) of the operating system or an application that can be used to inject malicious code. For this e.g. API calls on the operating system are monitored and blocked if they match a known attack. Another technique determines the normal behavior of an application and takes countermeasures as soon as it deviates. Intrusion detection alone cannot prevent every type of threat, but it can make an infection much more difficult.

Machine learning is one of the most modern approaches to malware analysis. The aim of this approach is to create an artificial intelligence that can independently distinguish “good” from “evil”. The vendor uses various training models to make the difference understandable to his algorithm. After completing this training period, the algorithm is then able to apply the knowledge learned and make his own decisions. Machine learning can be available either on the local endpoint or in the vendor’s cloud. With this approach, too, it is necessary for the provider to intervene and make adjustments. The number of false alarms that occur (false positives) is particularly important and depends on the quality of the algorithm and the knowledge learned.