Traditional antivirus software is installed on millions of individual computers around the world but according to researchers, antivirus software from popular vendors is increasingly ineffective. The researchers observed malware --malicious software--detection rates as low as 35 percent against the most recent threats and an average window of vulnerability exceeding 48 days. That means new threats went undetected for an average of seven weeks. The computer scientists also found severe vulnerabilities in the antivirus engines themselves.
The researchers' new approach, called CloudAV, moves antivirus functionality into the "network cloud" and off personal computers. CloudAV analyzes suspicious files using multiple antivirus and behavioral detection programs simultaneously.
"CloudAV virtualizes and parallelizes detection functionality with multiple antivirus engines, significantly increasing overall protection," said Farnam Jahanian, professor of computer science and engineering in the Department of Electrical Engineering and Computer Science.
Jahanian, along with doctoral candidate Jon Oberheide and postdoctoral fellow Evan Cooke, both in the Department of Electrical Engineering and Computer Science, recently presented a paper on the new approach at the USENIX Security Symposium.
To develop this novel approach, the researchers evaluated 12 traditional antivirus software programs against 7,220 malware samples, including viruses, collected over a year. The vendors tested were: Avast, AVG, BitDefender, ClamAV, CWSandbox, F-Prot, F-Secure, Kaspersky, McAfee, Norman Sandbox, Symantec and Trend Micro.
Traditional antivirus software that resides on a personal computer checks documents and programs as they are accessed. Because of performance constraints and program incompatibilities, only one antivirus detector is typically used at a time.
CloudAV, however, can support a large number of malicious software detectors that act in parallel to analyze a single incoming file. Each detector operates in its own virtual machine, so the technical incompatibilities and security issues are resolved, Oberheide said.
CloudAV is accessible to any computer or mobile device on the network that runs a simple software agent. Each time a computer or device receives a new document or program, that item is automatically detected and sent to the antivirus cloud for analysis. The CloudAV system the researchers built uses 12 different detectors that act together to tell the inquiring computer whether the item is safe to open.
CloudAV also caches analysis results, speeding up the process compared with traditional antivirus software. This could be useful for workplaces, for example, where multiple employees might access the same document. The new approach also includes what the developers call "retrospective detection," which scans its file access history when a new threat is identified. This allows it to catch previously-missed infections earlier.
The researchers see promising opportunities in applying CloudAV to cell phones and other mobile devices that aren't robust enough to carry powerful antivirus software.
CloudAV Project Summary:
http://www.eecs.umich.edu/fjgroup/cloudav/
Provided by University of Michigan
Related stories:
Turn off an idle computer, or leave it running?
Q. Sometimes a day or two can pass without anyone using our desktop computer. Should we leave it on or turn it off? Do we extend the life of the hard drive when the PC is turned off?
Don't give in to ‘scareware'
Q. Recently my computer was attacked by a program named Antivirus XP 2008 that, while claiming to protect your computer, is actually a virus itself.
Wake-up call: Draft security pub looks at cell phones, PDAs
In recent years cell phones and PDAs—"Personal Digital Assistants"—have exploded in power, performance and features. They now often boast expanded memory, cameras, Global Positioning System receivers and the ability to record and store multimedia files and transfer them over wireless networks—in addition to the cell phone system—using WiFi, infrared and Bluetooth communications. Oh, yes, and make phone calls.
Computer scientists set on winning the computer virus 'cold war'
First came the virus. Then came the antivirus software. Ever since, virus programmers have been escalating their technology, trying to stay one step ahead of the computer security engineers and vice versa.
Probing Question: What are computer viruses and where do they come from?
Just as the flu can spread from human to human, a well-engineered computer virus can transfer from machine to machine--with a bad outbreak affecting tens of thousands, or even millions, of systems. Indeed, in a high-tech age, the potential for a large-scale mechanical meltdown makes computer viruses almost as much of a threat as the biological kind.
Protecting your Computer: Part 3 – AntiVirus
by Philip Dunn [ Part 1 ] [ Part 2 ]
Almost everybody is aware of the need for Antivirus software, so this article will concentrate on installation issues and virus removal.
Protecting Your Computer: Part 2 - Firewalls
by Philip Dunn [ Part 1 ]
While rather new to computing in comparison to antivirus programs, in today’s Internet connected world firewalls are actually more important.
Google Announces the Google Pack
Google announced the Google Pack beta, a free collection of useful software from Google and other companies that improves the user experience online and on the desktop. In just a few clicks, users can install and maintain software to surf the web faster and safer, communicate better, and effectively manage information.
