Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1098835" data-attributes="member: 32260"><p>I do not know if &quot;dead&quot; is the best choice, I used it as the opposite of the term &quot;alive&quot; = present on the attacker servers or malicious domains used in the attack. Many samples can be &quot;alive&quot; in the wild for a short time (several minutes up to a few hours, and disappear). The short &quot;alive&quot; time causes a low prevalence of the sample (some AVs are impacted by the sample in the wild, and some are not). The behavior of the sample is often different at the time when it is &quot;alive&quot; in the wild and at the test time when it is &quot;dead&quot;. During the test time, some AVs detect the sample by a signature created on the basis of the &quot;alive&quot; behavior. Other AVs will try to detect the sample on the basis of the &quot;dead&quot; behavior. To avoid this, one must test the malware as soon as possible. Any delay increases the error, so more samples must be tested to keep that error sufficiently low.</p></blockquote><p></p>

[QUOTE="Andy Ful, post: 1098835, member: 32260"] I do not know if "dead" is the best choice, I used it as the opposite of the term "alive" = present on the attacker servers or malicious domains used in the attack. Many samples can be "alive" in the wild for a short time (several minutes up to a few hours, and disappear). The short "alive" time causes a low prevalence of the sample (some AVs are impacted by the sample in the wild, and some are not). The behavior of the sample is often different at the time when it is "alive" in the wild and at the test time when it is "dead". During the test time, some AVs detect the sample by a signature created on the basis of the "alive" behavior. Other AVs will try to detect the sample on the basis of the "dead" behavior. To avoid this, one must test the malware as soon as possible. Any delay increases the error, so more samples must be tested to keep that error sufficiently low. [/QUOTE]

Verification