Re:NirSoft Freeware (2008)
by digi_owl on Monday April 16, 2018 @05:41PM
(#16853072)
Another thing is that actions malware take and actions legitimate "power user" software takes are separated only by context. Thus automated behavior analysis is always going to produce false positives.
[ Parent
| on HN ]
Is there much behaviour analysis done by consumer AV? Even Defender seems to be mostly signature based.
Re:NirSoft Freeware (2008)
by neko_koneko on Tuesday April 17, 2018 @04:50AM
(#16856586)
Yep. Malware is constantly repacked/encrypted. It is impractical/impossible to write static unpacking engines for every type of malware packing technique, so behavioral analysis engine is a must (btw, behavioral engines still detect malware using signatures).