FAQ. Faster Scans and Better Virus Detection Can They Do That? How to break the old trade-off between effectiveness against malware and speed

Transcription

1 Faster Scans and Better Virus Detection Can They Do That? How to break the old trade-off between effectiveness against malware and speed 1. If you are evaluating antivirus products, you face a dilemma. Should you choose a package that is unobtrusive to users, that scans quickly and doesn t slow down computers at awkward moments, even if it misses malware? Or should you select an alternative that detects the most malware, even if its slow performance causes user complaints and motivates power users to turn off security features? There is no way to avoid this trade-off as long as security products are tied to a client-heavy architecture. Yet there are innovative methods that make it possible to scan faster and detect more viruses by utilizing: 1. A cloud-based architecture 2. Advanced behavior recognition technologies This document will answer a few key questions about how these methods can break the performance/detection trade-off and give you the best of both worlds. It also summarizes some tests that validate these results. 2. Traditional antivirus products are based on the idea of distributing threat signatures to endpoints and using the resources of the endpoint systems to compare files with those signatures. This approach is no longer viable, because: Endpoint systems do not have the capacity to perform matching operations against the more than 70 million known malware variants. Inevitable lags in distributing signatures leave systems vulnerable to zero-day attacks. Massive signature downloads eat up network bandwidth and cause headaches for system administrators. Sponsored by:

2 3. Conventional antivirus products find a hash (unique signature) for each file on the workstation, and then use the CPU and memory of the workstation to compare the hashes with millions of known malware signatures. Not surprisingly, this compute-intensive task affects the performance of every process on the computer. Moving signature-matching activities to the cloud completely changes the dynamics of antivirus screening. A cloud-based system can use massive servers to perform intensive pattern matching with no impact on the performance of the endpoint workstation. It can then send messages to the workstation about which files should be quarantined and which should be allowed to execute (Figure 1). Figure 1: A cloud-based system can offload pattern-matching from endpoints, stop zero-day attacks and eliminate large signature file downloads. Customer Data Feeds External Threat Data Feeds File Hashes Workstation Known File Hash Database In addition to improving performance on the workstation, this architecture provides two other benefits: The cloud-based system can identify zero-day attacks by obtaining real-time threat data feeds from test laboratories, antivirus clearinghouses, security vendors and enterprises. Pattern-matching in the cloud eliminates the need to download large signature files to the endpoints every day Hackers and cybercriminals have become skilled at creating malware variants different enough from known files to escape detection by signature matching. Is there another layer of defense that can be added without degrading the performance of endpoint systems? 1 According to AV-Test, an independent IT security institute, over 55,000 new malicious software programs are registered daily. 2

3 Yes, there is another layer of defense: behavior recognition technology (Figure 2). As programs execute: A client module on the workstation records changes the program makes to the file system, disk, registry and memory. A list of the changes (behavior data) is sent to a cloud-based system. The cloud-based system compares the behavior data with a database of behaviors of both good and bad programs. The behavior data is also analyzed by a set of rules that determine whether the behavior is benign or malicious. The cloud-based system sends messages to the workstation about which programs should be quarantined and which should be allowed to execute. Figure 2: Behavior recognition compares changes made on the workstation with behaviors of good and bad programs. Customer Data Feeds External Threat Data Feeds Workstation Behaviors Data Behaviors Database Not only does behavior recognition detect many malware variants that evade signature matching, it can also be performed in the cloud with almost no impact on workstation performance. A number of refinements can be added to this process for example, having the client on the workstation roll back changes made by bad programs. Some of these will be discussed in the next section. 5. Webroot has radically rethought antivirus technology by implementing cloud-based signature matching, behavior recognition and other innovations enabled by a cloudcentered architecture. 3

4 The Webroot SecureAnywhere Business Endpoint Protection solution utilizes an extremely small client (less than 1MB) on endpoint systems, including remote laptops and workstations inside the corporate firewall (Figure 3). Figure 3: The Webroot SecureAnywhere Business Endpoint Protection solution: Intensive pattern matching and behavior analysis offloaded to the cloud; minimal impact on end users. Remote Laptop Users (client app<1mb) Webroot Customer Data Feeds External Threat Data Feeds Admin Console (browser) REAL-TIME FILE DATA Known File Hash Database Behaviors Database Other Threat Database Corporate Workstations (client app<1mb) Webroot Intelligence Network Because pattern matching and behavior analysis are offloaded to Webroot s cloud-based systems, the SecureAnywhere clients can scan entire PCs in under two minutes the first time and in under one minute in subsequent scans. Not only do Webroot s servers perform pattern matching and behavior analysis at extremely high speeds, but they also have access to the Webroot Intelligence Network (WIN) with over 75TB of threat data and rules vastly more than could be accommodated on endpoint workstations. Webroot has added several powerful refinements to the concepts described above. For example: If a program is identified as malware, the client will delete the offending software, and it can also roll back all of the changes the malware made, including modifications to files, memory and the registry. Rollback not only prevents data breaches, but it also reduces the need to reimage systems after an attack. The client can stop malware from stealing passwords to accounts, banking sites and social networking sites by blocking methods used to lift keystrokes and grab screens. Blacklists and whitelists can be used to further control which programs can execute. Policies and tests are put in place to prevent infection when endpoint systems are offline. Webroot SecureAnywhere Business Endpoint Protection does not conflict with other endpoint security solutions, so it can be deployed as a second layer of protection. 4

5 The bottom line: By rethinking antivirus technology and implementing a cloud-centered architecture, Webroot has broken the old trade-off and given you a way to scan faster and detect more viruses (and also reduce your administrative workload). 6. What is the proof that these ideas work in practice? Independent testing labs have shown that Webroot products have exceptionally small footprints and remarkably fast performance. One comparison of eight anti-malware vendors by PassMark Software, a leading independent antivirus testing lab, showed Webroot coming in first in 8 of 10 performance and footprint tests, and second in the remaining two. 2 In many of these tests, Webroot s product outperformed its nearest competitor by a factor of 2 or a factor of 10. For example, installation time was six seconds for Webroot, whereas the closest competitor took more than 10 times as long and one best-selling product took 100 times as long. Initial scan time was 50 seconds for Webroot, versus 79 seconds for the next-best product and 156 seconds for the worst. Tests of resource utilization showed similar results. Most important, memory usage during initial scan was 12MB for Webroot, compared with 57MB for the nearest competitor and 233MB for the biggest memory hog. A selection of the results from this test is shown in Table 1. Table 1: Selected Results from PassMark Software Performance Tests of Endpoint Security Products Except for the overall score, lower figures are better (faster/smaller). Webroot Kaspersky McAfee Microsoft Symantec Trend Micro Overall Score (out of 80) Installation Time (seconds) Initial Scan Time (seconds) File Write, Open, Close (seconds) Installation Size (MB) Memory Usage During Initial Scan (MB) Memory Usage During System Idle (MB) Products tested: Webroot SecureAnywhere Endpoint Protection; Kaspersky Endpoint Security 8.0; McAfee Total Protection for Secure Business; Microsoft Forefront Endpoint Protection; Symantec Endpoint Protection 12.1 Small Business; Trend Micro Worry Free Business Security 7.0 Standard 2 PassMark Software, Webroot SecureAnywhere Endpoint Protection Cloud vs. Seven Traditional Endpoint Security Products, updated February competitors_6feb2012.pdf 5

6 These results were corroborated by a subsequent battery of tests by PassMark, which showed Webroot coming in first or second in 13 of 17 tests. 3 A test by AV-Comparatives, another leading independent lab, gave Webroot the highest performance score of 20 vendors, with perfect scores on 9 of 10 tests. 4 On the other side of the equation, Webroot customers do not need to sacrifice detection effectiveness to gain performance. A recent test by independent lab AV-Test gave Webroot an overall protection score of 99 out of 100, with perfect scores on protection against direct.exe downloads, protection against malicious attachments and protection against P2P attacks. 5 For more information visit: PassMark Software, 2012 Consumer Security Products Performance Benchmarks, Edition 4, updated April 12, AV-Comparatives, Anti-Virus Comparative Performance Test (Suite Products), revised June 15, AV-Test, Real World Protection and Remediation Testing Report, updated February 10, now/en/pu/images/promotions/2012/pdf/real-world-and-remediation-testing-report.pdf 6 Sponsored by: