The Anti-virus Times

Wednesday, October 19, 2016

An anti-virus consists of multiple components. The anti-virus engine (which receives requests from other components), the behavioural analyser, and cloud technologies (which use statistics showing how programs are operating on multiple hosts) can perform a direct analysis of malware programs.

Suppose a certain program starts requesting access to user data or starts processing a large number of files. What’s at work here? Is it spyware or a program that secures confidential information? Encryption ransomware or a legitimate encryption application?

How can an anti-virus tell malware from legitimate programs?

Anti-virus analysts and programmers have a great responsibility. If an anti-virus mistakes a rarely used file for malware, it’s somewhat unpleasant, but doesn’t do much harm. A user can add the program onto an exception list, restore the file from the quarantine, or choose the correct action to be taken when prompted by the anti-virus.

If the anti-virus wrongly recognises a system component or a component of its own (incidents of this kind occurred many times) as malware, the adverse impact will be far greater. The system can be rendered non-operational. Imagine if this happens, say, to half of all the computers in China!

Why do anti-virus false positives occur?

There exist many reasons.

• The growing number of malicious files means that virus analysts may not have enough time to examine them (including their design and behaviour). Heuristic technologies, which enable anti-viruses to use information about various types of malware in order to assess how dangerous a file may be, are one way around this. Heuristic technologies can use a single entry to detect thousands of malicious programs. However, when designing heuristic analysis routines, developers must avoid a number of pitfalls:
  • A heuristic analyser that is too suspicious can cause false positives—if the program being analysed contains pieces of code that are typical of malware.
  • A cautious heuristic analyser can easily be circumvented. As a rule, malware makers test their programs against the most popular anti-virus solutions before releasing them into the wild. They alter program code to make sure that it stays invisible to anti-viruses.
• The need to release updates as soon as possible (users are waiting!) also limits the amount of time spent developing and testing cures. Naturally, tests are automated, and the number of test system configurations is growing constantly, but there’s no way to check them all.
• Legitimate software updates. Alas, users don’t always update their software in a timely manner, and meanwhile, the latest updates are always installed on machines involved in anti-virus testing.

Users make mistakes too. Sometimes an anti-virus lets them choose what action to take with a certain file, and they make the wrong choice. Unfortunately, programmers who’ve written a suspicious program could have equipped it with malicious features as well as with useful ones. Many times software updates have resulted in data getting corrupted. Of course, this didn't happen because of ill intent, but sometimes malware makers can distribute malware in the guise of legitimate applications.