Reply to thread

Message

<blockquote data-quote="436880927" data-source="post: 824868">In the AV industry, this would usually refer to blocking behavior carried out by software.HIPS is a form of behavior blocking.Sandboxing is a form of behavior blocking.Dynamic heuristics might be a form of behavior blocking depending on how it functions - if it is just monitoring for behavior and using a scoring system then that is different.Dynamic heuristics with the scoring stuff isn&#039;t employed by every single dynamic heuristics implementation. All of it is vendor-dependent. It isn&#039;t a generic concept applied by literally everyone. There is no generic formula to it. One vendor&#039;s dynamic heuristics might just watch for one or two things and immediately quarantine the sample when those two expectations are met, whereas another might wait for a score threshold and update the score depending on what the application is doing.Interpret it differently if you want, whatever. This is getting old. I&#039;m yawning. I&#039;m unfollowing the thread. Please can no one involve me in this debate again.</blockquote>

[QUOTE="436880927, post: 824868"] In the AV industry, this would usually refer to blocking behavior carried out by software. HIPS is a form of behavior blocking. Sandboxing is a form of behavior blocking. Dynamic heuristics might be a form of behavior blocking depending on how it functions - if it is just monitoring for behavior and using a scoring system then that is different. Dynamic heuristics with the scoring stuff isn't employed by every single dynamic heuristics implementation. All of it is vendor-dependent. It isn't a generic concept applied by literally everyone. There is no generic formula to it. One vendor's dynamic heuristics might just watch for one or two things and immediately quarantine the sample when those two expectations are met, whereas another might wait for a score threshold and update the score depending on what the application is doing. Interpret it differently if you want, whatever. This is getting old. I'm yawning. I'm unfollowing the thread. Please can no one involve me in this debate again. [/QUOTE]

Verification