Researchers develop next-generation computer antivirus system

Aug 06, 2008
Researchers develop next-generation computer antivirus system

(PhysOrg.com) -- Antivirus software on your personal computer could become a thing of the past thanks to a new "cloud computing" approach to malicious software detection developed at the University of Michigan. Cloud computing refers to applications and services provided seamlessly on the Internet.

Traditional antivirus software is installed on millions of individual computers around the world but according to researchers, antivirus software from popular vendors is increasingly ineffective. The researchers observed malware --malicious software--detection rates as low as 35 percent against the most recent threats and an average window of vulnerability exceeding 48 days. That means new threats went undetected for an average of seven weeks. The computer scientists also found severe vulnerabilities in the antivirus engines themselves.

The researchers' new approach, called CloudAV, moves antivirus functionality into the "network cloud" and off personal computers. CloudAV analyzes suspicious files using multiple antivirus and behavioral detection programs simultaneously.

"CloudAV virtualizes and parallelizes detection functionality with multiple antivirus engines, significantly increasing overall protection," said Farnam Jahanian, professor of computer science and engineering in the Department of Electrical Engineering and Computer Science.

Jahanian, along with doctoral candidate Jon Oberheide and postdoctoral fellow Evan Cooke, both in the Department of Electrical Engineering and Computer Science, recently presented a paper on the new approach at the USENIX Security Symposium.

To develop this novel approach, the researchers evaluated 12 traditional antivirus software programs against 7,220 malware samples, including viruses, collected over a year. The vendors tested were: Avast, AVG, BitDefender, ClamAV, CWSandbox, F-Prot, F-Secure, Kaspersky, McAfee, Norman Sandbox, Symantec and Trend Micro.

Traditional antivirus software that resides on a personal computer checks documents and programs as they are accessed. Because of performance constraints and program incompatibilities, only one antivirus detector is typically used at a time.

CloudAV, however, can support a large number of malicious software detectors that act in parallel to analyze a single incoming file. Each detector operates in its own virtual machine, so the technical incompatibilities and security issues are resolved, Oberheide said.

CloudAV is accessible to any computer or mobile device on the network that runs a simple software agent. Each time a computer or device receives a new document or program, that item is automatically detected and sent to the antivirus cloud for analysis. The CloudAV system the researchers built uses 12 different detectors that act together to tell the inquiring computer whether the item is safe to open.

CloudAV also caches analysis results, speeding up the process compared with traditional antivirus software. This could be useful for workplaces, for example, where multiple employees might access the same document. The new approach also includes what the developers call "retrospective detection," which scans its file access history when a new threat is identified. This allows it to catch previously-missed infections earlier.

The researchers see promising opportunities in applying CloudAV to cell phones and other mobile devices that aren't robust enough to carry powerful antivirus software.

CloudAV Project Summary: www.eecs.umich.edu/fjgroup/cloudav/

Provided by University of Michigan

Explore further: Computer software accurately predicts student test performance

add to favorites email to friend print save as pdf

Related Stories

Facing the Windows XP apocalypse? Here are some options

Mar 26, 2014

Are you ready for the "XP Apocalypse" on April 8? That's when Microsoft Corp. plans to stop issuing security updates for the aging, but still-popular XP version of its flagship Windows operating system, which ...

Ransoms paid by two of every five victims of CryptoLocker

Feb 28, 2014

New research from the University of Kent has revealed that around 40% of people who fall victim to an advanced form of malware, known as CryptoLocker, have agreed to pay a ransom of around £300 to recover their files.

Thanks to geotagged photos, are you sharing too much?

Feb 17, 2014

Whipping out your smartphone to snap and post online pictures of yourself and your kids relaxing at home - or perhaps that pricey new TV you just hung on your rec-room wall - is like throwing chum to a sea of hungry sharks.

There's no better time for governments to go open source

Feb 03, 2014

The UK government has revealed that it is considering ditching Microsoft software for open source alternatives. Cabinet minister Frances Maude has said he wants to see a range of software being adopted by ...

Recommended for you

Sony's PlayStation 4 sales top seven million

1 hour ago

Sony says it has sold seven million PlayStation 4 worldwide since its launch last year and admitted it can't make them fast enough, in a welcome change of fortune for the Japanese consumer electronics giant.

Weibo IPO below expectations, raises $285.6 mn

2 hours ago

Sina Weibo sold fewer shares than expected in its US IPO which was priced below expectations ahead of a Thursday listing that takes place after tech selloffs on Wall Street.

'Chief Yahoo' David Filo returns to board

3 hours ago

Yahoo announced the nomination of three new board members, including company co-founder David Filo, who earned the nickname and formal job title of "Chief Yahoo."

Fired Yahoo exec gets $58M for 15 months of work

3 hours ago

Yahoo's recently fired chief operating officer, Henrique de Castro, left the Internet company with a severance package of $58 million even though he lasted just 15 months on the job.

User comments : 1

Adjust slider to filter visible comments by rank

Display comments: newest first

gmurphy
not rated yet Aug 07, 2008
use linux, protection through obscurity!

More news stories

Sony's PlayStation 4 sales top seven million

Sony says it has sold seven million PlayStation 4 worldwide since its launch last year and admitted it can't make them fast enough, in a welcome change of fortune for the Japanese consumer electronics giant.