AV Isn't Dead, It Just Can't Keep Up

[Dima007]

Brand new malware is detected by only around half of antivirus programs on the day it first appears, an analysis by security startup Lastline Labs has found after running samples through the VirusTotal online scanner.

Over the last year, the firm ran hundreds of thousands of pieces of malware it had encountered through the service to see how many of the 47 antivirus products correctly identified the files as malicious.

On the first day the overall detection percentage averaged 51 percent of the programs, which rose slowly until suddenly ramping up to 61 percent about two weeks after the malware’s first submission.

Measuring detection rates using VirusTotal is not a new idea and the firm's results were more or less as might be expected; antivirus software gets better and better at spotting malware as time passes, but the detail reveals some important caveats. When no program on VirusTotal spotted a piece of malware on the first day, it took an average of two days for at least one program to detect it.

Without naming any names, it is clear that some antivirus programs are still better (i.e. faster) at detecting new malware than others, with some examples managing to elude one in ten scanners a full year after their first appearance.

So does all this tell us whether antivirus software works or not? On the basis of Lastline’s findings, the answer probably depends on what is understood by the word 'works'.

The firm found that around 1 percent of malware is stubbornly hard to detect using the signature technology that is the core of antivirus software. This unusual and presumably rare malware sits undetected for months and might never make it into signature databases of any product. Indeed, they were probably specially crafted to evade signature detection by simply not being common enough to be quickly spotted and fingerprinted.

This is not good if you happen to be one of the small group of firms being targeted by these programs but that's been true for some time.

“We think that ‘traditional’ AV technology is not dead, but needs to be complemented with other approaches (e.g., based on dynamic analysis of samples, network anomaly detection) that provide additional signals for detection,” argued Lastline Labs’ CTO, Giovanni Vigna.

“For us, this preliminary dataset leaves us with as many questions as answers.”

As ever, it’s a line that chimes with the argument by a range of more recently-founded security firms that the technology employed by the established brands is no longer good enough as a single line of defence and should be supplemented with newer technology.

Ironically, it’s a message that increasingly works for the larger traditional AV vendors such as Symantec, which recently surprised the security world after an executive recently told the Wall Street Journal that antivirus software was “dead.” But Symantec increasingly wants its business user base to move to more recent products too and timed its historic admission to coincide with the announcement of new systems.

Lastline itself jumped the Atlantic, launching a UK wing in London’s Tech City last November.

 

[Dima007]

Much has been said in recent weeks about the state of AV technology. To add facts to the debate, Lastline Labs malware researchers studied hundreds of thousands of pieces of malware they detected for 365 days from May 2013 to May 2014, testing new malware against the 47 vendors featured in VirusTotal to determine which caught the malware samples, and how quickly.

The focus of this test is to determine how fast the anti-virus scanners catch up with new malware.

Note that the configuration of the various AV scanners used by VirusTotal is not necessarily optimal, and it is always possible that a better detection rate could be achieved by relying on external signals or using more “aggressive” configurations.

On any given day, according to Lastline Labs’ analysis, much of the newly detected malware went undetected by as much as half of the AV vendors. Even after 2 months, one third of the AV scanners failed to detect many of the malware samples. By averaging the daily detection rates, we are able to plot the pace at which the AV scanners catch up with the malware. The least-detected malware - that is the malware in the 1-percentile “least likely to be detected” category - went undetected by the majority of AV scanners for months, and in some cases was never detected at all.

Some other interesting findings of this Lastline Labs research:

• On Day 0, only 51% of AV scanners detected new malware samples
• When none of the AV scanners detected a malware sample on the first day, it took an average of two days for at least one AV scanner to detect it
• After two weeks, there was a notable bump in detection rates (up to 61%), indicating a common lag time for AV vendors
• Over the course of 365 days, no single AV scanner had a perfect day - a day in which it caught every new malware sample
• After a year, there are samples that 10% of the scanners still do not detect

View Full Size

Top 1% of malware evolved against AV patterns
As you can see in grey lines in the chart above, there is a steady growth curve in the detection rates from Day 0 to Day 365 of the average malware. This pattern mostly mirrors that in the 1-percentile malware trajectory (percentiles based on least detected) which are likely more sophisticated or unique. The 1% of malware that most effectively evaded detection in this dataset is likely to represent the kind of advanced malware created and exploited by cyber-criminals who are persistently and directly targeting and infiltrating organizations, as opposed to more opportunistic malware distributors.

AV alone is not enough
For us, this preliminary dataset leaves us with as many questions as answers. This analysis does not single out any AV vendor, and provides only insights based on VirusTotal data (with the caveats expressed at the beginning). We think that “traditional” AV technology is not dead, but needs to be complemented with other approaches (e.g., based on dynamic analysis of samples, network anomaly detection) that provide additional signals for detection.

In future analyses, we will be looking for patterns in the least-detected malware that may indicate common trends or behaviors that could help all network security - including AV scanners - improve malware detection effectiveness and speed. This data definitely points to the conclusion that AV alone is not enough.

More research required
We plan to test further and compare the effectiveness of traditional sandboxing with next-generation sandboxing. Our hypothesis is that the least detectable malware is designed to both evade detection and fingerprint the analysis environment. From what we have seen so far, no commercially available signature-based security system appears to be able to get ahead of advanced malware on its own.

Source: http://labs.lastline.com/lastline-labs-av-isnt-dead-it-just-cant-keep-up

 

[Ink]

Good opportunity for other markets, an AV will never be the top dog in security. But how can a sandbox determine between good and bad actions?

Remember GesWall? Awesome product, but no longer actively developed.

 

[nsm0220]

and that why most avs have zero day protection because they can't keep up with the malware anymore