Timeline for Is signature based malware detection a thing of the past?
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 20, 2020 at 18:34 | vote | accept | Aravind A | ||
| Apr 18, 2020 at 19:03 | comment | added | user10216038 | @Vivekanand V - Generally virus signature creation is a manual art. The trick is to define a signature that is likely sufficient and unique. If it's overly specific, minor variants will not be detected. If it's not unique, it generates false positives. Hashing is a quick triage before deciding to signature scan. | |
| Apr 18, 2020 at 18:52 | history | edited | user10216038 | CC BY-SA 4.0 |
terminology fix
|
| Apr 18, 2020 at 18:51 | comment | added | Aravind A | Can you please tell me how virus signatures are practically created, and how are they generated at runtime to match with the database and in what part of this protocol does Cryptographic hashing comes into play ? | |
| Apr 18, 2020 at 18:49 | comment | added | user10216038 | @Vivekanand V - I just added a detail update, you may have missed it. Virus signatures are not dependent upon the hash, they only make for a quick good/bad triage. Unknowns, including scripts, are scanned for signatures not hashes. You would have to know and alter the signature being used, an arbitrary script change will likely not do that as signatures are selected based upon key functionality. | |
| Apr 18, 2020 at 18:43 | comment | added | Aravind A | Thankyou for your answer ! But can you please tell me how will an AV detect malicious scripts ? Just a slight change in the text of a script (say a python script) will cause a different Cryptographic hash for it ! In that case will the AV have to shutdown the Python Interpreter forever ? | |
| Apr 18, 2020 at 18:38 | history | edited | user10216038 | CC BY-SA 4.0 |
Added detail for signature scan
|
| Apr 18, 2020 at 18:02 | history | answered | user10216038 | CC BY-SA 4.0 |