Serious Discussion iDefender

NormanF

Level 8
Verified
Jan 11, 2018
355
The company was renamed Trusing.

The translation offers an explanation of their HIPS software:

The difference between iDefender and other HIPS software

People often ask, what is the difference between iDefender and other HIPS software, and why choose iDefender instead of other security software.

iDefender breaks the traditional object-based operation protection model (such as file addition, deletion, modification, reading and other operation defense), adopts an innovative rule model based on scenario mode (such as prohibiting process startup, document protection, privacy protection), and designs. The rules engine based on templates + parameters greatly reduces the difficulty of editing defense rules. It also provides a rules market, making the sharing and acquisition of rules within easy reach.

In terms of performance, the iDefender rule engine adopts double cache mode, which improves the matching efficiency to the extreme. There is almost no performance consumption on the system without setting the rules incorrectly. There will be no memory growth or cumulative performance consumption during long-term operation. It is not only suitable for personal computers, but also for cloud servers.

iDefender completely uses the standard kernel API recommended by Microsoft to implement its functions. It has good compatibility and can coexist well with other security software.
 
Last edited:

B-boy/StyLe/

Level 3
Thread author
Verified
Well-known
Mar 10, 2023
144
Have you thought of writing some additional rules for iDefender HIPS to make it more robust? Worth looking into. It should be tweakable with custom rules.
Sound like a good idea. However, with my new job I rarely have the time to test and actively participate in malware analysis or security products reviewing, unfortunately. I am still actively submitting bugs to be fixed to various software and game developers tho and reporting missing malware samples to many security vendors, but still not like in my active/prime years ten years ago. :) But will try my best if I have more spare time to do so.
 

NormanF

Level 8
Verified
Jan 11, 2018
355
Sound like a good idea. However, with my new job I rarely have the time to test and actively participate in malware analysis or security products reviewing, unfortunately. I am still actively submitting bugs to be fixed to various software and game developers tho and reporting missing malware samples to many security vendors, but still not like in my active/prime years ten years ago. :) But will try my best if I have more spare time to do so.

A package of additional rules would make it stronger like the one a poster here compiled for Huorong Internet Security. A desideratum for the future.
 

B-boy/StyLe/

Level 3
Thread author
Verified
Well-known
Mar 10, 2023
144
Version 4.0 released. A lot of new features including a sandbox

Lol, this is a huge update with a lot of major changes. This version needs to be re-tested by @cruelsister and @Shadowra. :)
With Google Translate:
Major version update, it is recommended to update
Imonitorsdk update to 4.0
Add kernel rules engine
Add file hidden support
Add sandbox support
Add RPC call process traceability
Optimize some performance

template
Add built-in rules template
Add advanced template (kernel mode) support
Add file hidden template
Add lightweight sandbox template
Add domain name query template

Enhance defense
Add analog mouse keyboard monitoring
Add access to cut plate monitoring
Add a modification system time monitoring
Add key event monitoring
Add to modify desktop background monitoring
Add disk control monitoring
Inquiry bomb frame
Add signature information display
Add event customization
The bomb box response record supports the cache (the same event is not reminded by the same event by default, you can set it in the settings)
Intercept record
Add pagination support
Trust list
Support parameter array

optimization
Optimize the rules parameter settings
The disclosure part of the expired template
Optimize kernel process list performance
Add Image Holding Protection
Enhance self -protection logic
Add remote call traceability (service creation, driver loading, task plan, user creation, DNS query, etc. can be positioned to the source)
Add kernel level rules settings
Add WMI process to create monitoring
The rules group supports the introduction of shear plates
Parameter supports drag movement position

repair
Add the compatibility of the network filter driver
Optimize HKEY_CLASSSES_ROOT to redirect
Fix the error
 
  • Like
Reactions: harlan4096

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top