Reply to thread

Message

<blockquote data-quote="BoraMurdar" data-source="post: 824999" data-attributes="member: 2291">In todays terms behavior blockers doesn&#039;t exist, yet. All called BB use predefined rules or patterns, which can be static or updated (dynamic), more or less. Real BB should be able to detect a malicious behavior in a situations never seen before by the rules it follows. That could fall into Artificial Inteligence as the program could theoretically split good and evil by trial and error mechanism.BB X- is executed program trusted- does it ask for privilegdes elevation- does it access system files- is it modifying any of files- is it creating new files- etc.So, if rules are satisfied, programmer should code the new rule which says&quot; If all 5 are positive then trigger the remediation process, if 1,2 and 3 are positive modify heuristics to high (basically holds the current operation, copies the exe in question and continues the process in restricted or sandboxed environment).And so on...This way we cannot say where HIPS area of effect ends and where the BB starts.As long as program is only following those rules the programmer created, it is a HIPS or whatever you want to call it.When program can operate on its own and creates new rules by trial and error, then you can call it a Behavior Blocker.My 2 cents</blockquote>

[QUOTE="BoraMurdar, post: 824999, member: 2291"] In todays terms behavior blockers doesn't exist, yet. All called BB use predefined rules or patterns, which can be static or updated (dynamic), more or less. Real BB should be able to detect a malicious behavior in a situations never seen before by the rules it follows. That could fall into Artificial Inteligence as the program could theoretically split good and evil by trial and error mechanism. BB X - is executed program trusted - does it ask for privilegdes elevation - does it access system files - is it modifying any of files - is it creating new files - etc. So, if rules are satisfied, programmer should code the new rule which says " If all 5 are positive then trigger the remediation process, if 1,2 and 3 are positive modify heuristics to high (basically holds the current operation, copies the exe in question and continues the process in restricted or sandboxed environment). And so on... This way we cannot say where HIPS area of effect ends and where the BB starts. As long as program is only following those rules the programmer created, it is a HIPS or whatever you want to call it. When program can operate on its own and creates new rules by trial and error, then you can call it a Behavior Blocker. My 2 cents [/QUOTE]

Verification