More Calls For Behavior-Based Virus Fighting

from the of-course dept

It's no surprise to see this article so soon after such a major virus outbreak. People are wondering, yet again, how come our anti-virus systems work in a reactive way - after discovering a virus, pushing out an updated virus definitions file to protect subscribers. The problem, of course, is that this only happens well after the virus is in circulation. So, once again, we get calls for more pro-active, behavior-based anti-virus protection. Since the last big virus outbreak, a few such products have started appearing on the market. Though the initial offerings are mostly focused on enterprise users, they're likely to trickle down pretty rapidly. Still, I stand by my earlier prediction that behavior-based virus fighting will have unintended consequences. First, it will end up blocking/stopping certain legitimate behaviors that the system interprets incorrectly as virus activity. Second, it will just encourage virus writers to adapt and start writing viruses that piggyback on legitimate uses in order to sneak past the filters. It's pretty clear that current anti-virus methods aren't working, but behavior-based anti-virus fighting may not be the best solution either.