What do AV Products do and how are they tested?

[A Guy]

After writing the previous entry on vendor-sponsored tests and seeing comments about it, I thought it might be good to explain what AV products do, how they typically gets tested, and how they should be tested. And, I will discuss a bit in a more thorough fashion what is wrong with the testing that was performed by Dennis Technology Lab. I had attempted in the previous posting to illustrate the uselessness of the DTL testing with humor—it did not work with some people (especially at least one Symantec person). So, here is a more straightforward approach.

I thought it would be good to start with a basic tutorial on what antivirus software does…….

The bad guys are trying to get a bad payload (malware) into the user’s computer. This malware/payload could be benign (such as current Conficker) or it could be designed to steal passwords, bank information, open a backdoor for a hacker, etc. The malware can also be a virus, spyware, Trojan horse, etc. It makes no difference in the detection and that is why all good AV/security products include anti-spyware capabilities. Regardless, the purpose of AV is to stop the bad guy from getting the malware into the computer. In the past these attempts were made almost entirely through emails—sometimes SPAM email and sometimes email received from a trusted source with an infected computer.

Currently we see that over 80% of infection routes are via internet browsing. Sometimes the infections come from know bad sites (often hacking sites, sex sites, etc.). But these days, mostly they come for a bad guy infecting a legitimate website. These infections are usually a java script that once downloaded and executed on the user’s computer installs a piece of malware.

Now, there are also other means to infect a user computer (such as over the network, a hack attack, etc.). But as the email and website vectors are the two most common, I will concentrate on them. First, here is a simple diagram showing what an AV product does to provide protection during these activities.

[Only registered and activated users can see links. ]

A Guy