F-Secure 17.5 beta 10 (now with Avira signatures)

[Lord Ami]

Hello all!

Seems like with latest beta, FS changed from Bitdefender to Avira engines.
Detection names speak for themselves:


Old engine was Aquarius (with Bitdefender signatures), new one is named Capricorn (with Avira signatures).

Quoting F-Secure team member

"Aquarius has been replaced with our new Capricorn engine. Capricorn is our new cloud-hybrid file and URL analysis service for F-Secure's endpoint products — for all platforms."

What do you think about such switch? One instant change I saw is smaller size of signature's folder (couple of hundred of megabytes).

 

[upnorth]

The stable version still use Aquarius. Will be interesting with this new engine in upcoming tests in the HUB.

 

[Pirate_fin]

So, this is why they said that version 17.5 will be their biggest change in years. Can't wait for final version to be released.

 

[amico81]

what could be the reason for the signature-change? the price? the falling protection of bitdefender-sigs?

 

[silversurfer]

Avira adds fresh malware faster to own signatures, so F-Secure might gets improved on detections by signatures/cloud...

 

[omidomi]

Its seems great , Nice Job F-Secure

 

[Faybert]

I was already for some time thinking of a change to F-Secure, not only for protection and privacy, but mainly for the excellent performance (lightness, without braking the navigation, games and etc), with this good news, I think the time has come

 

[upnorth]

https://malwaretips.com/threads/kraken-cryptor-v2-1.87778/#post-774379

https://malwaretips.com/threads/gandcrab-v5-04-02-11-2018.87789/post-774385

 

[Lord Ami]

I can comment that signature updates are way faster now, thanks to Avira's sigs being smaller and some of them offloaded to cloud. That's a good in my opinion - BD signature updates have always been somewhat clumsy.

 

[upnorth]

https://malwaretips.com/threads/mixed-threats-13-02-11-2018.87781/#post-774384

 

[ChemicalB]

Thanks for the news, I think they will have their reasons for switching to Avira signatures, but always in the awareness to improve the final product.

 

[kiric96]

Hello all!
Quoting F-Secure team member
.

Do you have the original post where thay talk about it, i was searching for it today and i could not find it :/ and yes it seems that the whole module is now from avira, i wonder if at the end it may decrease the detection rate.

I can comment that signature updates are way faster now, thanks to Avira's sigs being smaller and some of them offloaded to cloud. That's a good in my opinion - BD signature updates have always been somewhat clumsy.

errr, from what i know bitdefender adds signature every couple of hours (may be each 1 or 2 hours) in the case of avira (and checking with f-secure) they seem to release less signatures per day, as of right now the capricorn module shows that only 6 packages of signature have been rolled out, where in the case of bitdefender that count may double (10+ package signature)


PDT: like the new screen they added

 

[Lord Ami]

Do you have the original post where thay talk about it, i was searching for it today and i could not find it :/ and yes it seems that the whole module is now from avira, i wonder if at the end it may decrease the detection rate.

Here you go: Re: FS Protection PC 17.5 releases - Page 3 - F-Secure Community - 111694

errr, from what i know bitdefender adds signature every couple of hours (may be each 1 or 2 hours) in the case of avira (and checking with f-secure) they seem to release less signatures per day, as of right now the capricorn module shows that only 6 packages of signature have been rolled out, where in the case of bitdefender that count may double (10+ package signature)
View attachment 200742

PDT: like the new screen they added
View attachment 200741

True: VDF History
I kept eye on it and FS beta was kept up to date (maybe some minutes delay - but it was updated according to Avira VDF releases).
They also seem to be using Avira's cloud to some extent. From my test you can see that one of the detections was APC/Heur.
APC = Avira Protection Cloud.

Furthermore I tested the same pack with Avira and many of the TR/ etc detections had actually "Cloud" after them (static scan). So it's definitely interesting to see where it leads

 

[509322]

The reason F-Secure would transition to Avira's scanner is due to the high false positives of the F-Secure scan technology.

 

[Lord Ami]

The reason F-Secure would transition to Avira's scanner is due to the high false positives of the F-Secure scan technology.

I can not speak on behalf of FS but as I understand, they still include their own engines (Hydra and Virgo). Thus the scanner technology is more or less the same (except BD sigs). I doubt Bitdefender was the source of the FPs - it should be DeepGuard which blocked "rather rare" files that belonged to legit software or otherwise flagged legitimate files because of their behaviour.
I had this similar issue some months ago, but now the situation seems to be much improved (as reflected in ... khm, tests).

However, I do not know the technical side of the scanner engine. I could be wrong.

My 2 cents (and experience with it - for over a year).

 

[509322]

I can not speak on behalf of FS but as I understand, they still include their own engines (Hydra and Virgo). Thus the scanner technology is more or less the same (except BD sigs). I doubt Bitdefender was the source of the FPs - it should be DeepGuard which blocked "rather rare" files that belonged to legit software or otherwise flagged legitimate files because of their behaviour.
I had this similar issue some months ago, but now the situation seems to be much improved (as reflected in ... khm, tests).

However, I do not know the technical side of the scanner engine. I could be wrong.

My 2 cents (and experience with it - for over a year).

Then the next logical reason is Avira gave them a better deal.

 

[kiric96]

Here you go: Re: FS Protection PC 17.5 releases - Page 3 - F-Secure Community - 111694


True: VDF History
I kept eye on it and FS beta was kept up to date (maybe some minutes delay - but it was updated according to Avira VDF releases).
They also seem to be using Avira's cloud to some extent. From my test you can see that one of the detections was APC/Heur.
APC = Avira Protection Cloud.

Furthermore I tested the same pack with Avira and many of the TR/ etc detections had actually "Cloud" after them (static scan). So it's definitely interesting to see where it leads

Have you done these test without internet? by the way, do anyone knows if in the normal version of f-secure they still include BD engine? (fs-safe)

 

[Lord Ami]

Have you done these test without internet? by the way, do anyone knows if in the normal version of f-secure they still include BD engine? (fs-safe)

Normal still uses BD.

I've not done it without internet connection. I'll might as well do it with the next pack. Just for the sake of testing

 

[kiric96]

Normal still uses BD.

I've not done it without internet connection. I'll might as well do it with the next pack. Just for the sake of testing

let me know the results I guess that AVC is embedded into their security cloud as they use the same signature, it makes sense for me. I wonder why they never put bitdefender cloud into their own engine.

 

[Mariihh]

F-Secure realized the dream of avira lovers, who always asked for changes (new interface and a BB), but were never heard, simplifying, F-secure became what would be the ideal avira, with a good interface, lightness, and an acting blocker of behavior, In addition to the signatures (Avira and its own engine). F-Secure Point