Does Bitdefender AV have a file reputation mechanism?

[RoastedHaggis]

Hello, I'm planning to get an AV and so am checking up on various features of different AV's and so was wondering, does Bitdefender Antivirus have a file reputation mechanism, something akin to Kasperky's Application advisor? And if so, what are the odds of a file compiled by me being detected as a false positive? Like, how robust are those systems anyway? Because it seems like a big feature which some AV's proudly present, but I mean, if all it does is tell you that a file is "rare - therefore suspicious" it seems likely to be extremely prone to false positives, is that the case?

Also, if you could direct me to any documents that elaborate on that, that'd be grand.

Many thanks =)

 

[TrinitronMSDOS]

Hi, i see that you are a new member, so welcome to the MalwareTips community. I have no idea if Bitdefender offers this fonction. I reply to this message in hope that someone that is more familiar with the product will answer you. Usually questions or posts are answered quite promptly, i don't know why your post was left unanswered since a few days

 

[mlnevese]

It does have cloud features but no reputation check as far as I know.

 

[Sunshine-boy]

Only Eset and Kaspersky have such feature! kaspersky cant show the reputation for Dll and Sys files while Eset cloud can!

 

[TrinitronMSDOS]

Only Eset and Kaspersky have such feature! kaspersky cant show the reputation for Dll and Sys files while Eset cloud can!

Norton has a reputation tool as well, just for the info

 

[Sunshine-boy]

Ok, I didn't know that thanks.

 

[RoastedHaggis]

It does have cloud features but no reputation check as far as I know.

Cloud features but no reputation check? Could you please explain the difference? I was under the impression that a reputation check (one which is done automatically upon execution/download) is part of the cloud features.

It confuses me quite a bit as practically every av app that I checked had reputation features mentioned, for example here's regarding Bitdefender:
https://businessresources.bitdefend...ss-2015-SolutionPaper-ATC-93030-en_EN-web.pdf

"Bitdefender’s Global Protective Network (GPN) performs 11 billion queries per day, and uses reflective models and advanced machine
learning algorithms to extract malware patterns, ensuring real-time protection against any threat... It updates the reputation of apps, email sources and websites,
and broadcasts alerts."

So maybe we're talking about different things here? I would greatly appreciate anyone clearing the confusion, as I'm not even sure what "reputation features" entails at this point.

Many thanks for the warm welcome =)

 

[harlan4096]

I think He means a "comfortable" way to perform those checks, as Kaspersky has via just a left mouse click -> KSN and/or a click to access to the site: http://whitelist.kaspersky.com/advisor

 

[RoastedHaggis]

Makes sense, much obliged.

I have downloaded a trial version of Kaspersky Total Security and couldn't help but notice that it doesn't notify me whenever I'm running unknown files (like a hello world file which I just created, for example). I thought that the idea was essentially a whitelist of files, and whenever a file isn't known, the user is notified, it wasn't the case however. Could I be misunderstanding the idea of reputation here?
Thanks =)

 

[harlan4096]

By default KIS/KTS is installed in default settings (in Auto Mode), so average user will almost get any warning, but if You go to Application Control, probably You will see that Your unknown application has been moved to "Low Restriction" group...

To get warnings You have to enable "Interactive Mode" and make some others strong tweaks

 

[RoastedHaggis]

Many thanks!
So basically, a lack of reputation will not trigger a warning at any point? Kinda worrying that I have to set all settings on paranoid in order to get alerted whenever a file I'm about to launch is suspicious. Will it just, launch then?

 

[harlan4096]

No need to set all the security modules to paranoid...

You may search in Kaspersky section in this forum, many threads talking about it:

Kaspersky 2017 product maximize settings
Video Review - Kaspersky Internet Security 2017 (Maximum settings) Prevention and Detection Test
Kaspersky Trusted Application Mode (TAM): Maximum Settings
Q&A - Optimal Settings for Kaspersky Internet Security 2017?

Just do a research 1st and learn how the application really works

 

[mlnevese]

Cloud features but no reputation check? Could you please explain the difference? I was under the impression that a reputation check (one which is done automatically upon execution/download) is part of the cloud features.

It confuses me quite a bit as practically every av app that I checked had reputation features mentioned, for example here's regarding Bitdefender:
https://businessresources.bitdefend...ss-2015-SolutionPaper-ATC-93030-en_EN-web.pdf

"Bitdefender’s Global Protective Network (GPN) performs 11 billion queries per day, and uses reflective models and advanced machine
learning algorithms to extract malware patterns, ensuring real-time protection against any threat... It updates the reputation of apps, email sources and websites,
and broadcasts alerts."

So maybe we're talking about different things here? I would greatly appreciate anyone clearing the confusion, as I'm not even sure what "reputation features" entails at this point.

Many thanks for the warm welcome =)

Bitdefender will check any behaviour against its cloud and flag the software as dangerous blocking it. You just cant send a file to the cloud for checking yourself.

 

[mlnevese]

Many thanks!
So basically, a lack of reputation will not trigger a warning at any point? Kinda worrying that I have to set all settings on paranoid in order to get alerted whenever a file I'm about to launch is suspicious. Will it just, launch then?

Most antimalware products will not alert you unless the program you're trying to run tries to do something dangerous or presents suspect behavior. A "Hello World" program will just display a message on screen... that's not suspicious or dangerous.. now if it tried to elevate itself and access your documents folder, for instance, it would be instantly blocked as it's an unknown software trying to gain privileges.

To act otherwise would drive most users insane with alerts every five seconds or so...

There are default deny software out there and I believe that's what you're looking for from your questions.