Similar Searches

Related News

How Do You Find 200,000 Unique Samples a Day?

I recently received a couple of questions about signatures from a reader.
1- You said that ESET receives around 200000 unique malware samples daily, so does ESET detect most of them or detect only the malwares that their signatures are listed here: http://www.eset.com/threat-center/threatsense-updates ?
2- Nowadays why signatures are written? Are they written to detect malwares initially, or to cover the gap that heuristic can’t cover? Otherwise, is the main task of detection is of heuristics and signatures are considered supplement for that?
Let’s start with question 1. When detecting brand new unique threats, regular signatures are useless. There are a variety of heuristic approaches and one of them that is particularly effective is called generic detection. With generic detection we can identify new threats that are based upon existing threats. With a traditional signature a very slight modification to a virus or Trojan will break detection, but with a generic signature detection is not affected by minor changes. Some of the threats are detected with our passive heuristics. The scanner looks at the file and makes a determination that if the file is allowed to execute it will do something bad. Many other threats are detected with our active heuristics. With the active heuristics we build a virtual computer inside the scanning engine and actually run the samples. This allows us to observe what the program is (continue reading...)

Source: ESET ThreatBlog

Write a Comment

Copyright © 2012 The Security Blog. All rights reserved.