Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Reputation tests improve anti-virus performance

Web based malware blocking tools tested

Article comments

New reputation-based antivirus systems are doing a better job of blocking malicious software than did their predecessors.

That's what testing and certification company NSS Labs discovered when it looked at how good anti-virus software really is at blocking web-based attacks.

NSS tested nine anti-virus products by installing the software and then directing the PC to a battery of more than 3,000 websites that were known to be actively downloading malicious software to PCs. For two products, built by Trend Micro and McAfee, the tests took a look at how much so-called reputation-based malware detection systems really helped block malware. These reputation systems use a variety of techniques to size up a program and get a sense of whether it's trustworthy.

According to NSS President Rick Moy, anti-virus products that ship with reputation systems tended to do better in the tests. "Not all AV is the same," he said. "There are huge differences between anti-malware products, and the reputation systems are making a considerable impact."

With Trend Micro Internet Security and McAfee Total Protection, NSS compared how the software did with reputation-based detection turned both on and off. Trend Micro's software improved by 23 percent with the system active; McAfee's improved by 8 percent.

Trend Micro and McAfee were also the two quickest companies to protect customers from new strains of malware, NSS said.

Overall, Trend Micro Internet Security performed best in the NSS tests, catching malware 96.4 percent of the time. The number-two-ranked product, Kaspersky Internet Security, also uses a reputation system, although NSS wasn't able to turn it off to see how much it helped with detection.

These reputation-measuring techniques are supposed to enhance traditional signature-based AV products. With signature detection, the anti-virus company simply takes a kind of digital fingerprint of the code and then blocks any other program that has the same signature.

Reputation-based detection has become an important new area for anti-virus vendors, as criminals have become expert at jumbling up their malicious software so that digital signatures no longer work. "There's a lot of malware being missed by the security industry because it's being changed for every single visitor," said Carey Nachenberg, a Symantec fellow who created the company's new reputation-based detection system.

Trend Micro's reputation system works because it blocks specific URLs. But reputation systems can use a variety of factors to determine whether to block a program. Nachenberg's Symantec Reputation Based Security system, used by the just-released Norton Internet Security 2010, uses complex algorithms to figure out a program's reputation. (This version wasn't available when NSS conducted its tests.)

In essence, it's a lot like the film-rating system of NetFlix, making a prediction based on a number of factors. How long has the program been around? Where did it come from? How many people use it? "All these pieces of information can be correlated together and used to drive a reputation rating for every piece of software," Nachenberg said.

The top 4 consumer AV products, as rated by NSS based on the percentage of malware caught, were as follows:

  1.  Trend Micro Internet Security 2009 / 96.4 percent
  2.  Kaspersky Internet Security 2009 / 87.8 percent
  3.  Norton Internet Security 2009 / 81.8 percent
  4.  McAfee Total Protection Suite 2009 / 81.6 percent



Share:

More from Techworld

More relevant IT news

Comments

Nasty Virus Collector said: I think the analysis is completely unfairWhat do you call Reputation systemsAnd what about the Reputation of those anti-malware companiesMost anti-malware today mislead its users detecting simple game cracks as trojans or uncategorized malware There is becoming more and more difficult to tell if a file really contains a virus or not because antivirus companies only care about statistics and be on the top of the list of detections

Mitchell said: I think that listing the top 4 performers without giving a complete list of the tested products is a bit misleading and unfair I would have liked to see how my lta hrefhttpwwwsophoscomgtantivirusltagt of choice fared but I dont even know if it was tested



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *