Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 823434" data-attributes="member: 32260">The problem with behavior blocking comes from the fact that modern AVs can block the file both due to its behavior and design. For example, the below file features can hardly be connected with behavior:<ol>
<li data-xf-list-type="ol">The source from the file was downloaded.</li>
<li data-xf-list-type="ol">The file prevalence.</li>
<li data-xf-list-type="ol">The file digital certificate (EV, standard, open source, SHA1, SHA256, no certificate).</li>
<li data-xf-list-type="ol">The file entropy.</li>
<li data-xf-list-type="ol">The code similarities to the known malware.</li>
<li data-xf-list-type="ol">etc.</li>
</ol>The above factors can be crucial for making decisions by machine learning models. Some AVs will block the malware without any information about using the behavior models, so many users think that the AV does not have any.Edit.As usual, I can agree with most facts posted by Veloce. We differ only with interpretations and semantics, which are not important to this thread. The main fact is that many users do not see AV behavior-based features if these features are not called Behavior Blocker.</blockquote>

[QUOTE="Andy Ful, post: 823434, member: 32260"] The problem with behavior blocking comes from the fact that modern AVs can block the file both due to its behavior and design. For example, the below file features can hardly be connected with behavior: [LIST=1] [*]The source from the file was downloaded. [*]The file prevalence. [*]The file digital certificate (EV, standard, open source, SHA1, SHA256, no certificate). [*]The file entropy. [*]The code similarities to the known malware. [*]etc. [/LIST] The above factors can be crucial for making decisions by machine learning models. Some AVs will block the malware without any information about using the behavior models, so many users think that the AV does not have any. Edit. As usual, I can agree with most facts posted by Veloce. We differ only with interpretations and semantics, which are not important to this thread. The main fact is that many users do not see AV behavior-based features if these features are not called Behavior Blocker. [/QUOTE]

Verification