Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 823465" data-attributes="member: 32260">The AV technologies evolve and the terminology evolves too. Some AV vendors like Emsisoft still use the term Behavior Blocker, probably to maintain product continuity, but this term seems less appropriate when machine learning technologies are involved.Even a Zero-day term is not clear nowadays. A few years ago it was related exclusively to exploits. So, the Zero-day protection had a meaning to protect against Zero-day exploits.To avoid confusion it is better to say about protection/prevention against UDs or FUDs.UD - undetectable by signatures, but uses known techniques so can be detected/removed by one or more AVs.FUD - undetectable by AVs for some time.The protection against FUDs may look strange, but it is possible in the era of machine learning based on the complex telemetry from all computers in the AV network (Big Data Analytics). The AVs will miss the FUD malware, so it can infect some computers. But after some minutes/hours the telemetry from infected computers can alarm the AV cloud. The infection chain is now analyzed by the special methods including human expert analysis and most FUDs will be detected in this way and the infection cannot spread out.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />So, you probably are interested in AVs with strong UD protection like CIS, KIS, etc.</blockquote>

[QUOTE="Andy Ful, post: 823465, member: 32260"] The AV technologies evolve and the terminology evolves too. Some AV vendors like Emsisoft still use the term Behavior Blocker, probably to maintain product continuity, but this term seems less appropriate when machine learning technologies are involved. Even a Zero-day term is not clear nowadays. A few years ago it was related exclusively to exploits. So, the Zero-day protection had a meaning to protect against Zero-day exploits. To avoid confusion it is better to say about protection/prevention against UDs or FUDs. UD - undetectable by signatures, but uses known techniques so can be detected/removed by one or more AVs. FUD - undetectable by AVs for some time. The protection against FUDs may look strange, but it is possible in the era of machine learning based on the complex telemetry from all computers in the AV network (Big Data Analytics). The AVs will miss the FUD malware, so it can infect some computers. But after some minutes/hours the telemetry from infected computers can alarm the AV cloud. The infection chain is now analyzed by the special methods including human expert analysis and most FUDs will be detected in this way and the infection cannot spread out.(y) So, you probably are interested in AVs with strong UD protection like CIS, KIS, etc. [/QUOTE]

Verification