Reply to thread

Message

<blockquote data-quote="Nikos751" data-source="post: 1036134" data-attributes="member: 5403">Also, i want to add that while IPS can block malicious connections trying to establish, Sonar can work in the background collecting behavior data, so maybe detections can happen even after several hours or whole days, when many attributes show a higher malicious score. That&#039;s the way Sonar works from v4.0 released in 2012 and it&#039;s maybe a way to reduce FP&#039;s or submit more data to the NortonLifelock malware analysts.This way, a more sophisticated malware can be detected at endpoint level, for example logic bombs malware or other malware that can hide via time based tactics. More like an EDR with no ability to represent such abilities in video testing. Another product with a smaller analysis time threshold, will flag something as malicious or not malicious quickly, but if it misses something, things are more dangerous. I don&#039;t know for how long other vendors analyze behaviors, but this no-reaction time while blocking connectivity, brings me such thoughts to mind [USER=99014]@Trident[/USER] [USER=92939]@Shadowra[/USER]</blockquote>

[QUOTE="Nikos751, post: 1036134, member: 5403"] Also, i want to add that while IPS can block malicious connections trying to establish, Sonar can work in the background collecting behavior data, so maybe detections can happen even after several hours or whole days, when many attributes show a higher malicious score. That's the way Sonar works from v4.0 released in 2012 and it's maybe a way to reduce FP's or submit more data to the NortonLifelock malware analysts. This way, a more sophisticated malware can be detected at endpoint level, for example logic bombs malware or other malware that can hide via time based tactics. More like an EDR with no ability to represent such abilities in video testing. Another product with a smaller analysis time threshold, will flag something as malicious or not malicious quickly, but if it misses something, things are more dangerous. I don't know for how long other vendors analyze behaviors, but this no-reaction time while blocking connectivity, brings me such thoughts to mind [USER=99014]@Trident[/USER] [USER=92939]@Shadowra[/USER] [/QUOTE]

Verification