Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 775750" data-attributes="member: 32260">I can agree that it was the correct and proper definition, a few years ago. Technically, the zero-day had the meaning of the day when the vulnerability was published or the vendor was informed. This definition was probably incorrectly expanded to the new areas related to the machine learning, messaging security, AV cloud, etc.The meaning of terminology changes in time. That is the normal phenomenon in the living language. And it is normal, that many people will still understand the term in its narrow meaning.Nowadays, the term &quot;zero-day malware&quot; can also have a similar meaning like &quot;zero-hour malware&quot;. The second term may be related to:<ul>
<li data-xf-list-type="ul">AV detection based on machine learning (very quick detection).</li>
<li data-xf-list-type="ul">The response time of AV cloud, when the fingerprint of the malware is quickly created after the first infection event (AV AI, detonation in the sandbox, etc.).</li>
<li data-xf-list-type="ul">Messaging security, when threats are quickly detected by analyzing large numbers of messages in the network.</li>
</ul>AV-Test Lab,&nbsp; Britannica, popular websites &amp; magazines, etc., can use the term &quot;zero-day malware&quot; as related to the fresh malware samples not yet detected by AV signatures. Wikipedia uses the similar meaning for the term &quot;zero-day virus/malware&quot;.&quot;A zero-day virus (also known as zero-day malware or next-generation malware) is a previously unknown computer virus or other malware for which specific antivirus software signatures are not yet available....&quot;There also exist the term &quot;zero-day ransomware&quot; (not necessarily related to exploit).When reading some articles, it is often unclear what definition is used for the term &quot;zero-day malware&quot;. If the context is not related to AV machine learning, messaging security or AV cloud, then usually the malware uses unpatched vulnerability (by the vendor).Edit1I think that it would be better to keep the initial &quot;zero-day malware&quot; definition (related only to exploit), but this fight is already lost against the usus.Edit2In many cases we can see multistage &quot;zero-day attacks&quot;. The attack can start from the infected website which exploits the web-browser and system to download and run the final payload. The exploit can use unpatched vulnerabilities (one or more) and the payload can be the &quot;zero-day malware&quot; (fresh sample, no AV signatures).</blockquote>

[QUOTE="Andy Ful, post: 775750, member: 32260"] I can agree that it was the correct and proper definition, a few years ago. Technically, the zero-day had the meaning of the day when the vulnerability was published or the vendor was informed. This definition was probably incorrectly expanded to the new areas related to the machine learning, messaging security, AV cloud, etc. The meaning of terminology changes in time. That is the normal phenomenon in the living language. And it is normal, that many people will still understand the term in its narrow meaning. Nowadays, the term "zero-day malware" can also have a similar meaning like "zero-hour malware". The second term may be related to: [LIST] [*]AV detection based on machine learning (very quick detection). [*]The response time of AV cloud, when the fingerprint of the malware is quickly created after the first infection event (AV AI, detonation in the sandbox, etc.). [*]Messaging security, when threats are quickly detected by analyzing large numbers of messages in the network. [/LIST] AV-Test Lab, Britannica, popular websites & magazines, etc., can use the term "zero-day malware" as related to the fresh malware samples not yet detected by AV signatures. Wikipedia uses the similar meaning for the term "zero-day virus/malware". "[I]A [B]zero-day virus[/B] (also known as [B]zero-day malware[/B] or [B]next-generation malware[/B]) is a previously unknown computer virus or other malware for which specific antivirus software signatures are not yet available[/I]...." There also exist the term "zero-day ransomware" (not necessarily related to exploit). When reading some articles, it is often unclear what definition is used for the term "zero-day malware". If the context is not related to AV machine learning, messaging security or AV cloud, then usually the malware uses unpatched vulnerability (by the vendor). Edit1 I think that it would be better to keep the initial "zero-day malware" definition (related only to exploit), but this fight is already lost against the usus. Edit2 In many cases we can see multistage "zero-day attacks". The attack can start from the infected website which exploits the web-browser and system to download and run the final payload. The exploit can use unpatched vulnerabilities (one or more) and the payload can be the "zero-day malware" (fresh sample, no AV signatures). [/QUOTE]

Verification