Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 825265" data-attributes="member: 32260">On the beginning of XXI century, &#039;Behavior Blocker&#039; was something special and interesting in the AV industry, so people accepted that BBs are for blocking in a smart way some suspicious actions or some suspicious behavior patterns (Mamutu, ThreatFire, etc.). After that, people discovered that many of those suspicious behaviors can be in fact not blocked, but run isolated and virtualized. So, the vendors had a choice to block or run in a special environment. The second choice was named sandboxing. That is why people used the special meaning both for &#039;Behavior Blocker&#039; and for Sandbox. Both could use behavior blocking, but very differently. For example, the Sandbox will try to block any action which could break the isolation of processes in the Sandbox from processes outside the Sandbox. But, it will allow (via virtualization) most actions usually blocked by BB.Yet, the semantics can still matter if the term is rarely used. I am afraid that this could happen with BBs after the year 2010. Nowadays most AV vendors do not use the term &#039;Behavior Blocker&#039;&nbsp; (except G DATA and EMSISOFT). Most young IT professionals did not use BBs, and the traditional meaning of BB is unknown to them. They will prefer to interpret &#039;Behavior Blocker&#039; as something that can apply behavior blocking (HIPS, BB, Sandbox, Advanced Heuristics, etc.).</blockquote>

[QUOTE="Andy Ful, post: 825265, member: 32260"] On the beginning of XXI century, 'Behavior Blocker' was something special and interesting in the AV industry, so people accepted that BBs are for blocking in a smart way some suspicious actions or some suspicious behavior patterns (Mamutu, ThreatFire, etc.). After that, people discovered that many of those suspicious behaviors can be in fact not blocked, but run isolated and virtualized. So, the vendors had a choice to block or run in a special environment. The second choice was named sandboxing. That is why people used the special meaning both for 'Behavior Blocker' and for Sandbox. Both could use behavior blocking, but very differently. For example, the Sandbox will try to block any action which could break the isolation of processes in the Sandbox from processes outside the Sandbox. But, it will allow (via virtualization) most actions usually blocked by BB. Yet, the semantics can still matter if the term is rarely used. I am afraid that this could happen with BBs after the year 2010. Nowadays most AV vendors do not use the term 'Behavior Blocker' (except G DATA and EMSISOFT). Most young IT professionals did not use BBs, and the traditional meaning of BB is unknown to them. They will prefer to interpret 'Behavior Blocker' as something that can apply behavior blocking (HIPS, BB, Sandbox, Advanced Heuristics, etc.). [/QUOTE]

Verification