Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1049679" data-attributes="member: 99014">If you are really curious how behavioural blocking works, there are a lot of resources. In general you always have 3 steps.&nbsp;Step 1 is sensing and recording. To sense, behavioural blocking attaches hooks (a small module added to every program in user mode) and kernel driver.Windows is like a lego. It provides developers with a vast number of Applicable Programme Interfaces and functions. These interfaces (as well as various third-party ones) are called with parameters and that’s how the program works. For example creating a file doesn’t require you to write code from the scratch, you can just use CreateFile() function. By monitoring these calls you observe the behaviour. Not all calls can be monitored at all times as that will be a noisy and will degrade performance.Step 2 is classifying. To detect malicious processes, you must know how they act. Usually various classifiers are used and frequently deep learning classifiers run on the cloud side as well.Classifiers must be effective and accurate. They should not produce false positives.And step 3 is processing — once a process is convicted, remediation must be performed.By understanding how it all works you can easily see where attackers can play around.</blockquote>

[QUOTE="Trident, post: 1049679, member: 99014"] If you are really curious how behavioural blocking works, there are a lot of resources. In general you always have 3 steps. Step 1 is sensing and recording. To sense, behavioural blocking attaches hooks (a small module added to every program in user mode) and kernel driver. Windows is like a lego. It provides developers with a vast number of Applicable Programme Interfaces and functions. These interfaces (as well as various third-party ones) are called with parameters and that’s how the program works. For example creating a file doesn’t require you to write code from the scratch, you can just use CreateFile() function. By monitoring these calls you observe the behaviour. Not all calls can be monitored at all times as that will be a noisy and will degrade performance. Step 2 is classifying. To detect malicious processes, you must know how they act. Usually various classifiers are used and frequently deep learning classifiers run on the cloud side as well. Classifiers must be effective and accurate. They should not produce false positives. And step 3 is processing — once a process is convicted, remediation must be performed. By understanding how it all works you can easily see where attackers can play around. [/QUOTE]

Verification