1. About.com
  2. Computing & Technology
  3. Antivirus Software

Apply now to guide this site

Discuss in our forum

Mary Landesman

The Malware Naming Conundrum

By , About.com Guide   January 8, 2010

Follow me on:

In "Malware Threat Reports Fail to Add Up", Infosecurity mag takes antivirus vendors to task for not coordinating malware names. The article quotes a security researcher who erroneously claims that, "Because anti-malware vendors are also competitors, they have little incentive to work together on normalizing names and detection techniques."

In reality, one would be hard-pressed to find a more cooperative industry. The problem isn't a lack of sharing; the problem is an overabundance of malware. Since about 2004, the number of new malware signatures have been doubling year over year. Last year alone, Panda Labs reported processing 20 million new malware samples. That's an average of 55,000 per day in 2009 with no time off for holidays or vacations.

To counter the onslaught of new malware, much of today's detection is moving away from purely signature-based detection and beginning to rely more heavily on behavior-based methodologies and generic detection. This further compounds the naming challenges.

Your best bet: submit suspected malware samples to VirusTotal or Jotti for scan by multiple antivirus products. If you discover that your vendor is not detecting the sample but other vendors are, submit the sample directly to the antivirus vendor you use. That won't solve the naming problem, but it will help your vendor to prioritize the signature and help other users.

Comments
January 10, 2010 at 6:12 am
(1) industryEmployee :

The truth is that AV companies already share those samples without the user having to submit anything. Sites like Jotti use engines from different vendors, and the agreement is that if something is detected by one vendor and not by others, then the sample is automatically and immediately sent to the vendor(s) who did not detect the sample.

January 10, 2010 at 12:07 pm
(2) antivirus :

As the article states, submitting missed samples directly to the vendor “will help your vendor to prioritize the signature and help other users”. VirusTotal/Jotti submit all their samples, yes, but at tens of thousands of samples per day, prioritizing is key.

Leave a Comment

Line and paragraph breaks are automatic. Some HTML allowed: <a href="" title="">, <b>, <i>, <strike>
Related Searches conundrum malware

©2012 About.com. All rights reserved. 

A part of The New York Times Company.