Kaspersky calls home to prevent false positives
Posted on: 06/22/2012 04:19 PM
[
Comments
]
Eugene Kaspersky, co-founder of Kaspersky Lab, wrote on his blog that the company's anti-virus software will now call home to try to prevent false positives, before it notifies the user that it has detected malicious software. The software will now send information on the suspect file and the signature responsible for detecting it to a special database that is part of the Kaspersky Security Network ( KSN ) before it displays a warning to the user of what it found.
The cloud-based KSN service will check whether the file is on a whitelist and whether the signature is known to result in a false positive. In the past, this information would have been disseminated to clients via signature updates, resulting in delays of up to several hours or even days.
Kaspersky also revealed that the company works with so called "silent detections". This approach, he says, is used "to verify the most sophisticated detections" the user is not informed if the program sounds the alarm in response to such a signature. In so doing, this allows the company to identify any virus signatures which could cause large scale false positives on the user machines in advance.
Why double check on false alarms? The potential problems caused by false alarms was recently illustrated by Avira's anti-virus software, which made a mistake of blocking several harmless windows system processes. The result was that computers were almost completely disabled as they would no longer boot properly.
At the end of the post, Kaspersky notes that his company has applied for patents for its cloud-based anti-false-positive system, saying that "Unfortunately, for now we're in silent mode on this issue to avoid letting the cat out of the bag before all the patent applications have been filed. But Ill keep you posted!". Whether the process really is that novel is hard to say. According to security specialist Andreas Marx from anti-virus testing lab AV-Test, however, Kaspersky is one of the few security firms that makes good use of cloud computing to fight malware.
The cloud-based KSN service will check whether the file is on a whitelist and whether the signature is known to result in a false positive. In the past, this information would have been disseminated to clients via signature updates, resulting in delays of up to several hours or even days.
Kaspersky also revealed that the company works with so called "silent detections". This approach, he says, is used "to verify the most sophisticated detections" the user is not informed if the program sounds the alarm in response to such a signature. In so doing, this allows the company to identify any virus signatures which could cause large scale false positives on the user machines in advance.
Why double check on false alarms? The potential problems caused by false alarms was recently illustrated by Avira's anti-virus software, which made a mistake of blocking several harmless windows system processes. The result was that computers were almost completely disabled as they would no longer boot properly.
At the end of the post, Kaspersky notes that his company has applied for patents for its cloud-based anti-false-positive system, saying that "Unfortunately, for now we're in silent mode on this issue to avoid letting the cat out of the bag before all the patent applications have been filed. But Ill keep you posted!". Whether the process really is that novel is hard to say. According to security specialist Andreas Marx from anti-virus testing lab AV-Test, however, Kaspersky is one of the few security firms that makes good use of cloud computing to fight malware.
Comments
