An Immune System For The Internet?
from the until-it-gets-infected,-of-course dept
We've talked about the problems with many anti-virus solutions today that rely on a fingerprint of the virus that then gets sent out to client applications on a regular basis. It's a reactive approach that is often too late -- especially as new viruses are created and spread faster than ever. Another approach to fighting viruses is behavioral, where the anti-virus software tries to recognize actions commonly associated with viruses, and block them off. This has problems also, in that plenty of legitimate products may also take similar actions, and the new scam will be tricking people into "accepting" malicious software by having it piggyback on something legitimate. However, if the behavioral products are on the network, some can be decent at spotting threats -- but still they face the problem of distributing the protective code out to other machines fast enough. The infections move just as fast, if not faster, and they have a head start. So, some researchers have tried to attack the second part of that problem, and devised a system of honeypots that could be outfitted with the behavioral software. The trick, though, is that those honeypots would also be connected to each other "via a dedicated and secure network." Think of the dedicated network as a shortcut to all the important hubs. Thus, once one honeypot machine discovers a virus and cures it, it can widely distribute the cure very quickly. The researchers mathematically show that it would beat the virus to most machines -- and it gets even better as the network gets larger. Of course, even ignoring the questions about just how well this behavioral software can recognize a virus and create the "cure" code, it seems the bigger issue is how can you really keep that separate dedicated network secure? Wouldn't that be the immediate target of the determined hacker? They'd all want to figure out how to hijack that network to spread their viruses even faster.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
No Subject Given
[ link to this | view in chronology ]
AI based virus detector
[ link to this | view in chronology ]
Bad very bad idea
I think this is a very very bad idea.
ALTHOUGH
If done properly can render viruses useless. A system to detect viruses and distribute vaccines to uninfected systems can be handy.
[ link to this | view in chronology ]
No Subject Given
[ link to this | view in chronology ]
Anyone ever heard of IPS?
[ link to this | view in chronology ]
Techno-Darwinism
Hold on, some tall guy is at the door, he says he's from the future and he's here to kill me...
[ link to this | view in chronology ]
No Subject Given
[ link to this | view in chronology ]
Bait and Switch
[ link to this | view in chronology ]
Why not have an effort to "uninfect" or stop attac
This would work for at least the people who directly connect to the net, but not for trojan affected PC's, but I imagine there would be some reduction if this worked.
Trojans affected PC's might be behind firewalls, and therefor launching the attacks on you with no reverse course to take.
However it seems logical that if the systems were breached once, why not do it twice, or at least try as a way to reduce the "bot" armies
[ link to this | view in chronology ]
Reactive or proactive virus scanner?
The scanner should also recognize human patterns, accuracy, and activities, and be able to distinguish between those and a spoof.
[ link to this | view in chronology ]