Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1100349" data-attributes="member: 99014">[USER=79770]@Divine_Barakah[/USER] used signatures as an example of pre-execution protection. In reality, most of it is attributed to short if, then, else logics known as heuristics. Heuristic analysis involves emulating portions of the code in a secure environment, unpacking payloads to the core, looking for specific malware traits.We now have static analysis as well that looks at roughly 3-5k features of various file formats, running these features through decision trees.In reality, very solid bulk of detections nowadays are still generated by signatures, heuristics (dynamic analysis), reputation, third-party feeds, web-filtering and static analysis.Vendors then go further, by implementing post-execution protections that look at connections and behaviour. Whilst some of the implementations are dubious, other vendors excel in these areas.In Comodo, both the pre-execution and post-execution protections are abysmal, you are left just with the alert/prompt.This is the reason why others don’t by default bother you with these prompts, because they’ve got other cards up their sleeve.</blockquote>

[QUOTE="Trident, post: 1100349, member: 99014"] [USER=79770]@Divine_Barakah[/USER] used signatures as an example of pre-execution protection. In reality, most of it is attributed to short if, then, else logics known as heuristics. Heuristic analysis involves emulating portions of the code in a secure environment, unpacking payloads to the core, looking for specific malware traits. We now have static analysis as well that looks at roughly 3-5k features of various file formats, running these features through decision trees. In reality, very solid bulk of detections nowadays are still generated by signatures, heuristics (dynamic analysis), reputation, third-party feeds, web-filtering and static analysis. Vendors then go further, by implementing post-execution protections that look at connections and behaviour. Whilst some of the implementations are dubious, other vendors excel in these areas. In Comodo, both the pre-execution and post-execution protections are abysmal, you are left just with the alert/prompt. This is the reason why others don’t by default bother you with these prompts, because they’ve got other cards up their sleeve. [/QUOTE]

Verification