Security vendors leaving old-school malware detection behind

Step 1: Identify a computer virus specimen. Step 2: Create a "signature" to detect and eradicate the virus, and push the signature file out to a computer. Step 3: Repeat steps 1 and 2 again and again for new viruses and their variants.

That's how virus fighting has been done for decades in the antivirus software industry. But now some of the industry's biggest players say this methodology will be in decline in 2009 due to the rapidly multiplying malware epidemic.

Signature-based scanning is "static, old school," says Jerry Egan, director of product management at Symantec's security technology and response division. With 12,000 new malware specimens each day to detect and eradicate, "we think that technique is reaching the end of its useful life," Egan says.

Another complication is that malware is now so artfully designed, "it spreads to 20 or 30 machines before it mutates," Egan points out. That means "your neighbor has one variant and you have another. The effectiveness of each signature has gone down."

While Symantec isn't quite ready to jettison signature-based detection, the coming year is going to see a shift toward other antimalware techniques, including behavior-based protection, heuristics such as examining good and bad file characteristics, reputational analysis, and even whitelisting and blacklisting to allow or disallow code to run, says Egan.

"The shift will be to a hybrid model that employs these," Egan says about Symantec's product development going forward.

The view about signature-based detection is not so different at Trend Micro and Kaspersky Lab.

"Our experience is that there has been a 700% increase this year over last year alone in malware," says Peter Beardmore, senior product marketing manager at Kaspersky Lab. "This is absolutely challenging the traditional approach to signatures."

Kaspersky sees its detection model shifting, too. "Rather than the pattern of code, there's a pattern of calls made in that code," says Beardmore. "It might be calling the printer or registry," so the malware would be identified through more behavior-based methods.

Kaspersky will also be adding to all its desktop products the whitelisting and blacklisting approach it tried in its consumer products last summer through a partnership with Bit9. These technologies seem more adapted to the desktop right now, so Kaspersky hasn't pinpointed a strategy for this use in servers yet.

Page Break

Trend Micro's vice president of core technology solutions, John Maddison, agrees the malware epidemic is challenging traditional signature-based detection where signature files are downloaded and stored on the computer itself.

"By 2015, we predict upwards of 25,000 new signatures per hour just to keep up," says Maddison.

Trend Micro's approach, outlined by CEO Eva Chen in early 2008, is to put the signature patterns "in the cloud," with Trend Micro's SmartProtection detection. This approach, now in beta with 30 customers and expected to be rolled out in the second quarter of 2009, involves computers protected with Trend Micro's agent-based software that can query the cloud to detect and eradicate known malware.

For the enterprise, Trend Micro will simply "put a replication of the cloud on a server" and "the cloud will come to them," Maddison says. "The cloud has to become real-time with sophisticated updating methods to be updated almost instantly." Web-threat protection is another arrow in the quiver to detect malware, Maddison says.

Dave Marcus, director of security research and communications at McAfee, agrees signature-based detection "is less important than it was five years ago, when you consider the sheer volume of malware out there."

McAfee has already begun a shift to cloud-based malware detection, and sees behavior-based detection as a good augmentation as well. But Marcus adds: "Signature-based recognition will always be part of security technologies going forward."