Why Anti-Virus is Hard

Wednesday

Dec232009

Why Anti-Virus is Hard

Wednesday, December 23, 2009 at 9:48AM |

Every so often I am asked by a friend or a family member if I can tell if a file is a virus using just cursory inspection, and more often than not I receive a follow-up question on why it is so hard to do so. Before I get into why malware detection is so incredibly hard, it is helpful to take a brief diversion into the theoretical underpinnings of computer science.

There once was a man named Alan Turing, and he did many great things for this world. Not only was he instrumental in the cryptanalysis of Nazi communications during World War 2, he was one of the founders of the field we now refer to as computer science. During the course of his work he described a mathematical model for what we now refer to as a computer along with some fundamental limits on what can and cannot be computed. One of the problems examined by Turing was known as the halting problem. It states that the creation of a program that would be able to recognize if any arbitrary program run on any arbitrary input will come to a halt is impossible.

Beyond being mathematically interesting, the result has several important implications in the field of computer security. The proof of the halting problem states that it is impossible to know, through examination of a piece of software, if it is free of any security bugs. It is also impossible to know, through examination, if a piece of software is definitively not malware. That is why there has never been, and never will be, an end to computer viruses.

Just because something is labeled as impossible in computer science doesn't mean the problem can't be effectively solved, however. It is possible to catalog all of the major strains of viruses that exist in the world and store them in a massive database for clients to query. This database doesn't have to be limited to just known malware; one can build fingerprints that match families of viruses, which effectively stops not just the current viruses but all other similar viruses that the author will create. If you are really adventurous, one can track the spread and prevalence of new, suspicious binaries across a community of users and provide proactive blocking of the threat before an outbreak even occurs.

The problem is that all of these techniques require a huge amount of desktop resources to handle the current workload presented by contemporary malware. Our solution has been to move all of the data and computation work into an array of backend servers to reduce the slowdown on customer desktops. This architecture, known as "the cloud", has proven to be quite effective for us. It isn't what every AV firm is using, but we believe that it is the only solution that will be able to close the gap between practical antivirus and perfect antivirus going forward.

Email Article |

Print Article |

Permalink | Comments Off

Immunet Blog

Why Anti-Virus is Hard

Reader Comments (10)