Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 955392" data-attributes="member: 32260">The malware detection based on signatures/heuristics/ML/AI is very good but it is also limited by design. It requires &quot;Big data&quot; and relies on malicious/anomalous content. The problem is that malware evolves and can successfully mimic the legal/benign content. Nowadays the malicious behavior follows often from the context. The context cannot be properly recognized in the cloud via limited telemetry and privacy restrictions. Such malware can be better prevented by whitelisting methods applied locally.The stronger prevention follows from the whitelisting which is strongly adjusted to the particular computer. This creates diversity which is a big problem for malware, similarly to the diversity of immune systems of different species (goldfish will not die from COVID infection). That is why something like Nyotron Paranoid can be very efficient protection.Edit.In the Home environment, the whitelisting methods can be important for children, happy clickers, and casual users. Normally, the anti-ransomware protection based on signatures/heuristics/ML/AI is enough for most users. It is true that some users will be infected anyway, but chances for that are very low (probably similar to chances of death in a car accident).</blockquote>

[QUOTE="Andy Ful, post: 955392, member: 32260"] The malware detection based on signatures/heuristics/ML/AI is very good but it is also limited by design. It requires "Big data" and relies on malicious/anomalous content. The problem is that malware evolves and can successfully mimic the legal/benign content. Nowadays the malicious behavior follows often from the context. [COLOR=rgb(184, 49, 47)][B]The context cannot be properly recognized in the cloud via limited telemetry and privacy restrictions.[/B][/COLOR] Such malware can be better prevented by whitelisting methods applied locally. The stronger prevention follows from the whitelisting which is strongly adjusted to the particular computer. This creates diversity which is a big problem for malware, similarly to the diversity of immune systems of different species (goldfish will not die from COVID infection). That is why something like Nyotron Paranoid can be very efficient protection. Edit. In the Home environment, the whitelisting methods can be important for children, happy clickers, and casual users. Normally, the anti-ransomware protection based on signatures/heuristics/ML/AI is enough for most users. It is true that some users will be infected anyway, but chances for that are very low (probably similar to chances of death in a car accident). [/QUOTE]

Verification