Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 905941" data-attributes="member: 32260">So, what we can say about AV-Comparatives Malware tests?There were about 15000 different malware variants in March 2020 (according to the SonicWall statistics) and the statistical model from the previous post assumed m = 300000 malware (large pule of samples). It is probable that the tested samples included many polymorphic brothers, so one SonicWall malware variant was duplicated on average 20 times (20*15000 = 300000).I am not sure (I will check it tomorrow), but the large set of samples could be also several times greater if we would proportionally increase the number k of missed samples (confirmed, the differences are only minimal and not important even for m=8000000, k=1600).Now we can also understand what probably happened to TrendMicro which was compromised 82 times in the March test and was not compromised at all in September 2019.[URL unfurl=&quot;true&quot;]https://www.av-comparatives.org/tests/malware-protection-test-march-2020/[/URL][URL unfurl=&quot;true&quot;]https://www.av-comparatives.org/tests/malware-protection-test-september-2019/[/URL]TrendMicro could simply miss a few SonicWall malware variants that have many polymorphic variations among the tested samples. Other AVs apparently detected the malware samples that had many polymorphic variations.Furthermore, the k=60 (missed samples in the large set) is very small as compared to m=300000 (number of samples in the large set). It means that the samples were mostly not 0-day, but rather a few days old on average.</blockquote>

[QUOTE="Andy Ful, post: 905941, member: 32260"] So, what we can say about AV-Comparatives Malware tests? There were about 15000 different malware variants in March 2020 (according to the SonicWall statistics) and the statistical model from the previous post assumed m = 300000 malware (large pule of samples). It is probable that the tested samples included many polymorphic brothers, so one SonicWall malware variant was duplicated on average 20 times (20*15000 = 300000). I am not sure ([B][COLOR=rgb(184, 49, 47)]I will check it tomorrow[/COLOR][/B]), but the large set of samples could be also several times greater if we would proportionally increase the number k of missed samples ([COLOR=rgb(184, 49, 47)][B]confirmed, the differences are only minimal and not important even for m=8000000, k=1600[/B][/COLOR]). Now we can also understand what probably happened to TrendMicro which was compromised 82 times in the March test and was not compromised at all in September 2019. [URL unfurl="true"]https://www.av-comparatives.org/tests/malware-protection-test-march-2020/[/URL] [URL unfurl="true"]https://www.av-comparatives.org/tests/malware-protection-test-september-2019/[/URL] TrendMicro could simply miss a few SonicWall malware variants that have many polymorphic variations among the tested samples. Other AVs apparently detected the malware samples that had many polymorphic variations. Furthermore, the k=60 (missed samples in the large set) is very small as compared to m=300000 (number of samples in the large set). It means that the samples were mostly not 0-day, but rather a few days old on average. [/QUOTE]

Verification