Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 906198" data-attributes="member: 32260">What is really done in AV Labs tests?They try first to decrease the number of malicious samples in-the-wild and next perform the tests on the samples that are representative in some way to all samples in-the-wild.How it looks in numbers per month:A few millions of malware ----&gt; a few hundreds of the test samplesHow the AV Labs can do it is a kind of magic.Anyway, as it can be seen from the SonicWall reports, the number of different variants of malware is a few tenths thousands malware per month. They are probably good representatives of all samples in-the-wild.So, one must introduce a statistical model, because there are many possibilities of choosing the set of tested samples from hundreths times greater set of different malware variants.The statistical model in this thread is one of possible models. We simply take randomly the n samples from the larger set of m samples. The number of possibilities is enormous and can be calculated by using Binomial function B(m,n). For example:B(30000, 100) ~ 4.7 * 10^289,&nbsp; which is much greater than the number of atoms in the Universe.The details of the model are in OP. When we use this model to the real data, it is assumed that the tested AVs have very different sets of missed malware in the wild.</blockquote>

[QUOTE="Andy Ful, post: 906198, member: 32260"] What is really done in AV Labs tests? They try first to decrease the number of malicious samples in-the-wild and next perform the tests on the samples that are representative in some way to all samples in-the-wild. How it looks in numbers per month: [B]A few millions of malware ----> a few hundreds of the test samples[/B] How the AV Labs can do it is a kind of magic. [COLOR=rgb(0, 168, 133)][B]Anyway, as it can be seen from the SonicWall reports, the number of different variants of malware is a few tenths thousands malware per month. They are probably good representatives of all samples in-the-wild.[/B][/COLOR] So, one must introduce a statistical model, because there are many possibilities of choosing the set of tested samples from hundreths times greater set of different malware variants. The statistical model in this thread is one of possible models. We simply take randomly the n samples from the larger set of m samples. The number of possibilities is enormous and can be calculated by using Binomial function B(m,n). For example: B(30000, 100) ~ 4.7 * 10^289, which is much greater than the number of atoms in the Universe. The details of the model are in OP. When we use this model to the real data, it is assumed that the tested AVs have very different sets of missed malware in the wild. [/QUOTE]

Verification