About Us

The Immunet Blog is maintained by the Immunet team as a forum for discussing news and issues related to AntiVirus, security and cloud technology.

Search
« What to do When Advice Falls Short? | Main | Mariposa Botnet Suspects Nabbed by Spain - 13 million+ Zombie PCs Infected by Virus »
Sunday
Mar072010

How Immunet Detects Threats, In a Nutshell

I often get asked what makes Immunet’s approach to detecting threats different than the mainstream Anti-Virus companies.  In a nutshell, our goal is to find threats which are in small parts of our community, analyze them and then protect the whole community from them as fast as possible, often in near real time.

We do not focus on obscure threats, or threats which circulate outside of our community. We are not big fans of the 'boil the ocean' approach to doing Anti-Virus. It works well for reviewers (who test with everything under the sun) but it rarely really helps your community. There is a reason people are still getting viruses and it's time we rethink our (the industry) approach to tackling this problem.

As to 'how' we convict files. All of our current approaches entail communication back and forth with the cloud so that rarely is a decision made in 'decision support isolation’. This allows you to work with the most current, up to the minute, information that we have. Here are some of the approaches we use:

  1. Generic detection of threats through broad hashing. We look for things that look 'like' threats we know of and try to further analyze them for conviction so we can protect the community. This can also be called a 'heuristic' engine if you like.  Our generic engine is ETHOS; we have another planned for May, which is called SPERO.
  2. Context conviction, this is where we make decisions based off the data we receive about a file in field. From community collected data we can make assumptions about whether a file is a virus or not. For example, did our AV stop working after it was installed? Did the system start to see other viruses after it was installed? Questions like this will often lead to answers, which make us highly suspicious of a file.  
  3. One-to-One conviction, this is where there is a known threat we've collected from the community, through collection trading or gathered from web crawling. For each of these collected (and verified malicious files) we generate a signature. When users do file look-ups this signature is sent to us, if it matches a known threat we convict the file as a virus.


There are a few other ways as well and each of those approaches above could be a daylong chat on their own but that's the mile high view today (March 7, 2010).

 

PrintView Printer Friendly Version

EmailEmail Article to Friend

Reader Comments (84)

I really like this blog post, it has some great info. Thank you and keep up good work.

trading for a living

March 13, 2010 | Unregistered Commentertrading for a living

How will you convince me, that you will not collaborate with corporations in future ?
I'll take for example with gaming industry. People having original games, but using cracked versions to play the game w/o problems. If a game industry sends a cracked exe from multiple hosts, telling you that it contains a virus, will all the users in cloud get the fail-positive definitions and have their exe deleted ?

How is your software going to work, if a computer isn't connected to the web for some time ?
It still bases on the virus definition method, not on a completely fresh detection system.

Panda has already cloud antivirus. Would you dare to compare your solution with this ?

Don't take me wrong, I'm just curious.

May 25, 2010 | Unregistered CommenterJay

we provides you the best and most fashionable products. All the products are 100% high quality, competitive price, free shipping with best and timely service, 100% satisfaction. Big discount for big order. Welcome to make your choose.

ugg
ugg boots
ugg shoes
ugg tall boots
ugg short boots
ugg boots sale
ugg boots on sale
ugg boots on cheap
ugg discount
uggs
discount uggs
ugg sale
ugg kids
ugg women
ugg men
cheap ugg

gucci
gucci handbags
gucci bags
gucci wallet
gucci shoes>
gucci sunglasses
gucci men
gucci women
gucci cheap
gucci discount
gucci outlet

christian louboutin
louboutin
christian louboutin shoes
louboutin shoes
bridal shoes
sexy shoes
high heels shoes


ugg
ugg boots
ugg shoes
ugg tall boots
ugg short boots
ugg boots sale
ugg boots on sale
ugg boots on cheap
ugg discount
discount ugg
uggs
discount uggs
ugg sale
ugg kids
ugg women
ugg men
cheap ugg

weight loss
diet pills
how to lose weight fast


louis vuitton
replica handbags
lv
louis vuitton bags
louis vuitton handbags
discount handbags
lv
discount handbags
louis vuitton bags

louis vuitton
replica handbags
lv
louis vuitton bags
louis vuitton handbags
discount handbags
lv
discount handbags
louis vuitton bags

ed hardy
ed hardy clothing
ed hardy clothing shirts
ed hardy clothes
ed hardy t shirts

ed hardy
ed hardy clothing
ed hardy clothing shirts
ed hardy clothes
ed hardy t shirts

christian louboutin
louboutin
christian louboutin shoes
louboutin shoes
bridal shoes
sexy shoes
high heels shoes

christian louboutin
louboutin
christian louboutin shoes
louboutin shoes
bridal shoes
sexy shoes
high heels shoes

christian louboutin
louboutin
christian louboutin shoes
louboutin shoes
bridal shoes
sexy shoes
high heels shoes


christian louboutin
louboutin
christian louboutin shoes
louboutin shoes
bridal shoes
sexy shoes
high heels shoes

rosetta stone
rosetta stone software
rosetta

chaojimengnan supplier
chaojimengnan

mbt
mbts
mbt shoes
chesp mbt shoes
walking shoes
discount shoes
comfort shoes
discount mbt shoes

mbt
mbts
mbt shoes
chesp mbt shoes
walking shoes
discount shoes
comfort shoes
discount mbt shoes

mbt
mbts
mbt shoes
chesp mbt shoes
walking shoes
discount shoes
comfort shoes
discount mbt shoes

September 12, 2010 | Unregistered Commenterugg

how to learn various countries of language ? you can get the cheap rosetta stone.everyone can get the language which country of language want to learn ? Come on ! so value the software to learn all kinds of language ,pls from these cheap rosetta stone start ,LOL

September 14, 2010 | Unregistered Commentercheap rosetta stone

[url= http://www.buycheapchina.com/wholesale/Children-Gucci-Shoes-806_p1.html]louis vuitton handbags[/url]
[url= http://www.buycheapchina.com/wholesale/Armani-Short-Shirts-810_p1.html]puma shoes[/url]
[url= http://www.buycheapchina.com/wholesale/Mens-Boss-Ties-814_p1.html]brand perfumes[/url]
[url= http://www.buycheapchina.com/wholesale/Womens-Juicy-Sandanls-792_p1.html]gucci belts[/url]
[url= http://www.buycheapchina.com/wholesale/Womens-Coogi-Suit-796_p1.html]burberry jeans[/url]
[url= http://www.buycheapchina.com/wholesale/Juicy-Couture-For-Kid-602_p1.html]brand underwear[/url]
[url= http://www.buycheapchina.com/wholesale/Gucci-Handbags-646_p1.html]chanel sandals[/url]

September 14, 2010 | Unregistered Commenterbuycheapchina

Have a pair of beautiful Christian Louboutin and Pandora jewelry, and every woman is the desire, has a pair of Vibram Five Fingers and NFL Jerseys, fitness, each man's Insanity DVD.Christian Louboutin Knockoffs,Christian Louboutin Wedding Shoes,
Christian Louboutin Boots,Christian Louboutin Sandals,Christian Louboutin Wedges,Christian Louboutin Platform,Christian Louboutin Sneakers,Christian Louboutin Nappa Bootie,Christian Louboutin Ankle Boots,Christian Louboutin Leopard Boots,christian louboutin leopard,christian louboutin python pumps,christian louboutin black pumps,christian louboutin platform pump,Christian Louboutin Peep Toe,Christian Louboutin Declic Pumps,christian louboutin very prive pumps,Christian Louboutin Slingbacks,Christian Louboutin Cathay,Christian Louboutin High Heels,Christian Louboutin Pigalle,Christian Louboutin Mary Janes,Christian Louboutin Wedding Shoes,Christian Louboutin Declic Leather Pumps,Christian Louboutin Lace Up Boots,Christian Louboutin Robot,Christian Louboutin Peep Toe Boots,Christian Louboutin over the knee boots,christian louboutin babel boots,Christian Louboutin Bandage Boots,Christian Louboutin Bouquet Platform,Christian Louboutin Dillian Pumps,christian louboutin macarena,red sole shoes,Christian Louboutin Flats,Christian Louboutin Double Platform Sandal,Christian Louboutin Evening,christian louboutin calypso pumps,christian louboutin d'orsay,Christian Louboutin Alta Nodo,christian louboutin petal pumps,christian louboutin petal crepe satin sandal,replica christian louboutin shoes,Christian Louboutin Platform Pumps,Christian Louboutin Espadrille Wedge,Christian Louboutin Jeweled Pumps,christian louboutin cutout pump,Christian Louboutin Cutout Bootie,christian louboutin glitter pump,christian louboutin circus boots,christian louboutin sample sale,ED Hardy ED Hardy,Nike Shoes Nike Shoes,Abercrombie and Fitch Abercrombie and Fitch,Gift Ideas Gift Ideas,Tiffany Jewelry Tiffany Jewelry,Ball Bearing Ball Bearing,Christian Louboutin Christian Louboutin Discount,UGG Boots UGG Boots,EMU Boots EMU Boots,Louis Vuitton Handbags Louis Vuitton Handbags,Christian Audigier Christian Audigier

September 14, 2010 | Unregistered Commenter3

mbt
cheap nfl jerseys
Mbt
Nhl jerseys
Even life support. I don’t know how they got this close, but the only way they’re going to find out our exact location is to run into us. And if that happens, their sad little shuttle will crumple like cardboard.“

September 23, 2010 | Unregistered Commenterlide8805

Mbt
Nhl jerseys
mbt
cheap nfl jerseys

September 23, 2010 | Unregistered Commenterlide8805

mbt
cheap nfl jerseys

September 23, 2010 | Unregistered Commenterlide8805

dlyabc123
Knowledge isJewelry Findingsa comfortable glass beads and necessarywedding bags lasswork glovesbeadsretreat and shelterleather glovesfor us in anhair products advanced age; and if we do not plant it when young, it will give us no shade when we grow old.

September 25, 2010 | Unregistered Commenterdlyabc123
September 25, 2010 | Unregistered Commenterdlyabc123

I am the first time on this site and am really enthusiastic about and so many good articles. I think it’s just very good.
Jimmy Choo Pumps
Jimmy Choo Sandals
Jimmy Choo Slingbacks

September 25, 2010 | Unregistered CommenterVibram Five Fingers

There are many excellent quality designer clothes online from this clothing store. big discount!

September 26, 2010 | Unregistered Commenterwholesale designer clothes

Excellent designer handbags on sale at handbags outlet. many people like them!

September 26, 2010 | Unregistered Commenterwholesale designer handbags

Asics Gel Lyte iii http://www.asicsretail.com/asics-gel-lyte-iii-c-11.html
onitsuka tiger mexico 66 lauta http://www.asicsretail.com/onitsuka-tiger-mexico-66-lauta-c-12.html
asics tiger blog http://www.asicsretail.com/blog

mmovv.com provides massive virtual currency for MMORPG (massive multi-player online role playing game). Such as
knight noah
dragonica gold
lotro gold
2Moons dil
maplestory mesos
dfo gold
atlantica gold
Aion kinah
2moons dil
maplestory mesos
metin2 yang
mabinogi gold
tera gold
shaiya gold
Metin2 Yang
aika gold
aion kina
lineage 2 adena
mabinogi gold
dofus kamas
blade soul gold
c9 gold
dragon nest gold
last chaos gold
hero 108 gold
maplestory mesos
rom gold
ffxiv gil
mabinogi gold, there are 84-game list till now. You can nearly find all the games here. All of them are fantastic, and when you have more currency in game that we deliver to you, you can enjoy the game much more.

mmovv.com provides not only virtual items and currency service for multi-players on the internet, but also a massive trading platform where you can buy the items and currency from us, also can sell them to us.

At the same time, mmovv.com provides positive gaming service for you, creating a healthy, casual, and harmonious game environment where you will have more fun. So consumption on our website is an enjoyable thing.

Many interesting games here and I can't introduce all of them to you in the little space. So just come to our support live chat if you have any problems or contact us by the other way. We promise we will give you best satisfied service. And we believe you are our valued customer in the future and we will have lasting long time business and good friendship.

September 28, 2010 | Unregistered Commentermaplestory mesos
Comments for this entry have been disabled. Additional comments may not be added to this entry at this time.