The Anti-virus Times

Monday, January 16, 2017

Heuristic is a problem-solving approach based on a practical method that can be sufficient to achieve an immediate goal.

An anti-virus heuristic analyser is perceived by many to be a magic bullet. Typically, an explanation as to why anti-viruses fail to detect malware (or more precisely, why they can't detect all of it) is countered with the question: "And what about heuristics?" Let's try to answer it.

In order to detect malware, an anti-virus uses the signatures (also called definitions) in its virus databases. Heuristic technology also uses some of the entries in the databases. However, these entries contain information about entire groups of malicious programs. For example, if malware is generated using a special malware construction kit, all the applications spawned by the kit are likely to be detected with the aid of just one entry.

From this we can draw an important conclusion.

Heuristic technology can't detect malware programs about which it has no information.

This is not some sort of artificial intelligence but rather a sophisticated filtering rule with certain parameters. All the programs that do not match the filtering criteria are allowed to exist and operate in the system.

Is it possible to get around heuristic technology? In theory, this is relatively easy. Create new malware samples and test them on VirusTotal, or purchase and install all the popular anti-viruses and see if they detect the malware. As soon as anti-viruses cease to detect it, the malware can be deployed on target machines.

Is there a way to stay protected? Greed and complexity give advantages to security software.

First, criminals may not understand how certain anti-virus features work. Yes, some of them aren't high profile hackers but just people who want to make easy money. By submitting their malware to VirusTotal, they assume that they are guaranteed to find out whether their new malicious file will be detected. In reality, VirusTotal doesn't use all anti-virus features—there, files are only examined using virus databases. That is, in fact, essentially the way to test heuristic technologies. However, an anti-virus is no longer limited to virus databases and heuristic technologies—it can now scan scripts, make use of behaviour analysis, and much more.

Those who use just an anti-virus do so at their own peril. That’s because products of this kind do not incorporate features that supplement the capabilities of an engine. And if an anti-virus doesn't include a behaviour analysis feature, it won't be able to neutralise unknown threats; its developers are merely taking advantage of the myth that a good anti-virus can detect 100% of malware. Creating malware that will bypass its protection is not difficult at all. Criminals don't even need to buy anything—VirusTotal will suffice.