Reply to thread

Message

<blockquote data-quote="Nikos751" data-source="post: 1036116" data-attributes="member: 5403">From Norton&#039;s behaviour at recent tests I can understand that:<ul>
<li data-xf-list-type="ul">IPS works wonders</li>
<li data-xf-list-type="ul">AV is just good</li>
<li data-xf-list-type="ul">FP&#039;s have fallen down</li>
</ul>So,<ul>
<li data-xf-list-type="ul">For security industry known malware or malware that has a generally known/detectable behavior pattern, even unknown malware, vendors like BitDefender, Kaspersky Eset &amp; Avast will definitely do better -&gt; they can prevent infection</li>
<li data-xf-list-type="ul">For malware difficult to catch even via BB/ML, IPS will still popup as it&#039;s a network inspection mechanism, and malicious network behaviour patterns are more difficult to hide</li>
<li data-xf-list-type="ul">System will almost always be protected from leaking data as IPS blocks phone-home connections, this is the most important thing for financial malware &amp; malware downloading payloads.</li>
<li data-xf-list-type="ul">System can actually get infected, even if the malware cannot proceed to further actions, and it&#039;s not convenient to any degree</li>
</ul>So, when there is an IPS detection for Norton, it&#039;s vital for the user to run NPE (fortunately included) and maybe some other scanners for disinfection. No malware will go unnoticed or send important data to third parties even the nasty ones.But, all this can be true if IPS is really top notch and can detect anomalies (not just by network signatures), I cannot be sure about that, only assumptions from tests.</blockquote>

[QUOTE="Nikos751, post: 1036116, member: 5403"] From Norton's behaviour at recent tests I can understand that: [LIST] [*]IPS works wonders [*]AV is just good [*]FP's have fallen down [/LIST] So, [LIST] [*]For security industry known malware or malware that has a generally known/detectable behavior pattern, even unknown malware, vendors like BitDefender, Kaspersky Eset & Avast will definitely do better -> they can prevent infection [*]For malware difficult to catch even via BB/ML, IPS will still popup as it's a network inspection mechanism, and malicious network behaviour patterns are more difficult to hide [*]System will almost always be protected from leaking data as IPS blocks phone-home connections, this is the most important thing for financial malware & malware downloading payloads. [*]System can actually get infected, even if the malware cannot proceed to further actions, and it's not convenient to any degree [/LIST] So, when there is an IPS detection for Norton, it's vital for the user to run NPE (fortunately included) and maybe some other scanners for disinfection. No malware will go unnoticed or send important data to third parties even the nasty ones. But, all this can be true if IPS is really top notch and can detect anomalies (not just by network signatures), I cannot be sure about that, only assumptions from tests. [/QUOTE]

Verification