2007 - ESET_Heuristic-Analysis_- Detecting Unknown Viruses

2007 - ESET_Heuristic-Analysis_- Detecting Unknown Viruses...

Info iconThis preview shows pages 1–5. Sign up to view the full content.

View Full Document Right Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: www.eset.com Heuristic Analysis – Detecting Unknown Viruses Anti-virus does much more than reactively detect known viruses; it proactively scans for unknown ones too. So, how do scanners really work? David Harley Security Author and Consultant and Andrew Lee Chief Research Officer ESET LLC SMALL BLUE-GREEN WORLD 8 Clay Hill House, Wey Hill, Haslemere, SURREY GU27 1DA Telephone: +44 7813 346129 Fax: 44 8717 143451 http://smallblue-greenworld.co.uk 1.866.343.ESET (3738) 2 About the Authors David Harley David Harley has been researching and writing about malicious software and other security issues since the end of the 1980s. From 2001 to 2006 he worked in the UK’s National Health Service as a National Infrastructure Security Manager, where he specialized in the management of malicious software and all forms of email abuse, as well as running the Threat Assessment Center. Since April 2006 he has been working as an independent author and technology security consultant. David’s first major book was Viruses Revealed (Harley, Slade, Gattiker), Osborne’s comprehensive guide to computer virus protection. He has contributed chapters and editing to many other books on security and education, as well as a multitude of articles and conference papers. His latest writing project is as technical editor and major contributor to “The AVIEN Guide to Malware Defense in the Enterprise”, to be published by Syngress in 2007. Andrew Lee Andrew Lee, CISSP, is Chief Research Officer at ESET LLC. He was a founding member of the Anti-Virus Information Exchange Network (AVIEN) and its sister group AVIEWS (AVIEN Information & Early Warning System). He is a member of AVAR (The Association of Anti-virus Asia Researchers) and a reporter for the WildList International Organization, a group that maintains a list of computer viruses which are still “in the wild.” Before joining ESET, he spent his time managing malware defenses as a senior security administrator for a large government organization in the UK. Andrew is the author of numerous articles on malware issues, and is a frequent speaker at conferences and events including AVAR, EICAR, and Virus Bulletin. www.eset.com 3 Heuristic Analysis – Detecting Unknown Viruses Table of Contents Introduction Watching the Detectives Viruses Worms Non-replicative Malware What does Heuristic really mean? Signature Scanning The Opposite of Heuristics Generic Anti-virus I’m Absolutely Positive Sensitivity and Misdiagnosis Testing Issues Conclusion: A Heuristic Paradox References Glossary 1.866.343.ESET (3738) 4 Introduction “It ain’t what you don’t know that kills you, it’s what you know that just ain’t so.” Some of the most persistent myths in computing relate to virus and anti-virus (AV) technology. The widely-held belief that AV software can only detect specific, known viruses has been around since the early days of AV research. It wasn’t altogether true then; some of the first AV programs weren’t intended to detect specific viruses, but rather to detect or block...
View Full Document

This note was uploaded on 11/29/2010 for the course DEC 123 taught by Professor Fr during the Spring '10 term at ENS Cachan.

Page1 / 24

2007 - ESET_Heuristic-Analysis_- Detecting Unknown Viruses...

This preview shows document pages 1 - 5. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online