Is signature based malware detection a thing of the past?

Question

I made an experimental AV application to detect some test files as malware. It uses a simple signature based detection to detect those files. When my test AV encounters a file, it computes the SHA256 hash of that file, and then compares it with a database of hashes that are "deemed" malware. It will then either quarantine or delete that detected file... I realized that this method was very naive and will never offer any protection against zero day attacks or detect viruses whose hashes are not in the database. Also, professional AV software use sandboxing and API hooking to detect suspicious activity of executables. But consider this hypothetical case:

If I have the MD5 or SHA256 hashes of all known viruses till date in this world, will using only signature based detection give protection to my user.

In this age of self replicating viruses is signature based malware detection still used by Anti malware software to detect computer viruses or does it have some other applications when dealing with malware? What if the OS in which an Antivirus Software runs on does not give permission for API hooking or the system does not have enough resources (RAM) for sandboxing, then will signature based detection have some application ?

Answer 1

Signature Based Malware is still the dominant mechanism used.

Heuristic mechanisms do exist and are very useful in limited circumstances, but are subject to too many false positives for more general use.

What has happened in the AV industry across the board is an application of "Big Data". It's no longer a case of just checking against a database of known bad signatures. Most AV vendors, including Microsoft, will check the hash of all executables. That hash check can have three main results:

1. Known Bad (Isolate, Done!)
2. Know Good (continue, Done!)

3. Unknown (Scan for virus signatures)

   A. Signature Found (Isolate, Done!)

   B. Send a copy to the AV Vendor for Analysis

The immediate enhancement over your example test AV is the incorporation of Known Good hashes.

The less obvious but very powerful enhancement is the Big Data factor. When the AV company is doing this all over the world against billions of files, the chances of any given individual encountering a new 0-day drops dramatically, although it does still happen.

If you make your own executable, malicious or not, the third case will kick in. Microsoft, or most other large AV Vendors, will pull a copy of your executable and send it to their analysis teams. Here they will use heuristics during analysis and depending upon complexity, it will be fairly quickly entered into the worldwide database of executables.