Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1100999" data-attributes="member: 32260">Kaspersky SW is not entirely local and it cooperates with other AV modules.[URL unfurl=&quot;false&quot;]https://content.kaspersky-labs.com/se/media/pdf/Kaspersky_Lab_Whitepaper_System_Watcher_ENG.pdf[/URL]Bitdefender ATD is behavior monitoring + advanced heuristics. I did not find any information that it is entirely local.[URL unfurl=&quot;false&quot;]https://www.bitdefender.com/consumer/support/answer/2024/?srsltid=AfmBOop5wzNyv4GgruN0iQxutM66vjJyFVkB8a7O8n0Q22e10yu2wGpX[/URL]Anyway, Microsoft Defender works kinda similar. It has local behavior monitoring + local heuristics that can block most malware. But, from available tests, it follows that it works as a first defense layer. When the local modules cannot decide if the suspicious file is malicious, Defender can suspend the file execution (up to one minute, but the default delay is up to 10 seconds) and use the cloud backend for confirmation. The cloud backend uses advanced behavior-based modules trained by machine learning. It can also use sandbox, but it is not clear if this feature is available on Windows Home.Additionally, one can activate ASR rules that mainly work locally as a special behavior blocker related to exploit and post-exploitation prevention (Microsoft applications, Adobe Acrobat Reader, ransomware-specific methods, etc.).One ASR rule related to 0-day malware prevention depends on the cloud backend.</blockquote>

[QUOTE="Andy Ful, post: 1100999, member: 32260"] Kaspersky SW is not entirely local and it cooperates with other AV modules. [URL unfurl="false"]https://content.kaspersky-labs.com/se/media/pdf/Kaspersky_Lab_Whitepaper_System_Watcher_ENG.pdf[/URL] Bitdefender ATD is behavior monitoring + advanced heuristics. I did not find any information that it is entirely local. [URL unfurl="false"]https://www.bitdefender.com/consumer/support/answer/2024/?srsltid=AfmBOop5wzNyv4GgruN0iQxutM66vjJyFVkB8a7O8n0Q22e10yu2wGpX[/URL] Anyway, Microsoft Defender works kinda similar. It has local behavior monitoring + local heuristics that can block most malware. But, from available tests, it follows that it works as a first defense layer. When the local modules cannot decide if the suspicious file is malicious, Defender can suspend the file execution (up to one minute, but the default delay is up to 10 seconds) and use the cloud backend for confirmation. The cloud backend uses advanced behavior-based modules trained by machine learning. It can also use sandbox, but it is not clear if this feature is available on Windows Home. Additionally, one can activate ASR rules that mainly work locally as a special behavior blocker related to exploit and post-exploitation prevention (Microsoft applications, Adobe Acrobat Reader, ransomware-specific methods, etc.). One ASR rule related to 0-day malware prevention depends on the cloud backend. [/QUOTE]

Verification