Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

In one local magazine I read interview with Adrian Porcescu who is technical consultant in Kaspersky Lab. Anyway, among other, he says their anti-virus uses behaviourism and heuristic control to detect malicious softver.

I wonder - what is behaviourism and heuristic control in AV and how does it work?

Thank you in advance!

share|improve this question
2  
This is a very large topic. I recommend looking up white-papers on the topic (i.e. the eset paper at google.com/… ) – Ormis Jul 20 '11 at 21:53
This is a very broad topic. Could you ask a more specific question? Are you looking for theory or practice? – this.josh Jul 20 '11 at 23:17
@this.josh: Of course, if possible I would much more like practice then theory. However, theory is also fine. To be perfectly honest, I don't know how to ask specific question simply because I don't know what are heurisrics in behaviourism in AV industry. I found tons of information what are they in psyhology, but it doesn't have much with IT (e.g. heuristic approach to problem - if you don't know how to deal with problem, draw yourself a picture). – StupidOne Jul 21 '11 at 7:13

1 Answer

up vote 7 down vote accepted

Heuristic are:

  • learning techniques
  • common sense
  • discoveries

Their objective is to recognise a virus by analysing its code (not limited to). If a program is programmed to open a certain file, or to load/read certain memory address. These methods are based on multiple criteria. They eventually can run program in virtual environment to monitor for known virus schemes : replication, stealth etc.

Behaviourism is analysis in real time. By analysing what a program is doing (file I/O, memory I/O, network I/O, use of the PC during idle time, ...) you can assess whether it is legitimate or not. If one program begins firing packet on 100 IP addresses on each port, you can be sure it's a virus, because it is not a normal behaviour for a program.

I would conclude saying this: behaviourism deals with unknown behaviour (certainly try to profile the user behaviour to detect changes in normal activity) and it certainly uses heuristic. Heuristics objective is to detect an unknown virus, or variant, but the scheme they are looking for are well known.

Some references:

share|improve this answer
Great attempt to answer a difficult question. Do you have any references you could list? – this.josh Jul 20 '11 at 23:15
I've added some I've found when trying to answer. It's difficult to find a good source of information to justify all of the points. But as you said: it's a difficult question. I think that maybe the two techniques are sometimes overlapping. – M'vy Jul 21 '11 at 8:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.