My Digitized Thoughts - Ramen Mukherjee ...

Anti-virus companies are increasingly highlighting cloud-based capabilities of their products, extolling benefits such as “the speed of cloud computing to deliver real-time protection.” What does that mean? Let’s examine the key characteristics of cloud anti-virus products, surveying the technology while attempting to cut through the hype.

Defining Cloud Anti-Virus

I haven’t been able to locate an authoritative definition of cloud anti-virus, so I humbly propose my own:

Cloud anti-virus is anti-malware technology that uses lightweight agent software on the protected endpoint, while offloading the majority of data analysis to the provider’s infrastructure.

I believe this definition is consistent with the description, capabilities and architecture of most cloud anti-virus products.

Improving System Load with a Lightweight Agent

Cloud anti-virus employs agent software on the protected endpoint that is much lighter than the installed components of traditional anti-virus tools. This implies that cloud anti-virus imposes less strain on the system’s resources.

Instead of having to assess whether a file is malicious by performing analysis locally, the agent captures the relevant details from the endpoint and provides them to the cloud engine for processing.

To further improve performance, the agent can be more intelligent about how it intercepts file access prior to scanning. Panda Cloud Antivirus attributed performance improvement in their product to such redesign:

“Traditionally AV engines have intercepted files and objects in multiple layers (entry vector, file system and execution). In each layer, each object is scanned by multiple technologies, such as antivirus signatures, rules, heuristics, behavioral analysis, etc. This redundancy of scans results in a degradation of user experience…”

Programs that are about to be launched need to be analyzed before execution occurs. Files that have been downloaded, but not yet opened can be asynchronously scanned later when the system is idle.

The idea of sending a file for analysis even before it is being used was described earlier in the CloudAV: N-Version Antivirus in the Network Cloud paper by Jon Oberheide, Evan Cooke, and Farnam Jahanian. As the paper pointed out, this approach “amortizes the transmission and analysis cost over the time elapsed between file creation and system or user-initiated access.”

The relative simplicity of the agent installed on the endpoint decreases the attack surface of the local software, making it less likely that the anti-virus agent itself can be compromised due to a vulnerability.

Endpoint to Cloud Connectivity

If the endpoint is not connected to the Internet, its ability to protect the user is limited because it cannot query the anti-virus cloud. Cloud anti-virus can address this by storing a local cache of the most relevant queries on the end-point. The cache can also contain results of earlier queries, so that the files that have already been checked don’t need to be checked again.

The cache doesn’t provide the same detection capabilities for new files as the cloud service; however, the risk is balanced by the user being typically less vulnerable when disconnected from the Internet.

Network bandwidth limitations prevent most cloud anti-virus products from sending complete contents of files that need to be scanned. Instead, cloud anti-virus typically submits information about the file when seeking the cloud’s opinion about the file. As described by Yury Mashevsky in The Antivirus Weather Forecast: Cloudy, the meta data includes:

“the file’s unique identifier (the hash function), data about how the file came to be in the system, how it behaved, etc. New threats are identified in the cloud using metadata even though the files themselves are not actually transmitted to the cloud for initial analysis.”

Note that the file’s identifier may be its traditional hash, such as MD5. However, since polymorphic malware may change its code, relying on a traditional hash alone isn’t sufficient. The agent may need to capture fuzzy hashes as well as other descriptive information about the file to identify it.

Data Analysis in the Cloud

The processing of the data collected by agents on protected end-points is analyzed by the servers of the anti-virus service provider. If malicious activities are observed on some endpoints in association with files not previously considered malicious, cloud anti-virus updates its perspective on those files for the subsequent queries.

Yury Mashevsky described server-side processing of cloud anti-virus as an expert system that is automatically trained based on the input received from endpoint agents. One of the benefits of offloading analysis to the cloud is that the decision engine’s logic isn’t directly accessible to authors of malware, making it hardware for attackers to assess the tool’s effectiveness.

Jon Oberheide et al. discussed the possibility of deploying multiple scanning engines in the provider’s cloud. Some traditional anti-virus products deploy multiple engines directly on the endpoint. Moving the engines into the cloud would relieve the endpoint from having to deal with processing the load locally. However, to accomplish such scanning in the cloud, the endpoint would need to upload full file contents, rather merely transmitting the associated meta data.

Behavior Monitoring and Blocking

Cloud anti-virus is usually combined with other malware detection techniques, which are found in traditional anti-virus products. These approaches may include identifying malware based on suspicious heuristic or behavioral characteristics. Behavioral analysis may pick up on potentially-malicious actions on the endpoint such as:

• Modifying the “hosts” file
• Creating the “autorun.inf” file on a removable drive or a network share
• Sending a lot of email in a short period of time
• Generating new executable programs
• Modifying “auto-run” registry keys

When a certain threshold of suspicious actions is observed on the endpoint, the agent can block the relevant program and report the incident to the cloud. This way, other users of the product will benefit from the experience of other users.

Cloud anti-virus is a promising approach to protecting endpoints from malware. It is implemented by standalone tools and is incorporated into many traditional anti-virus products in attempts to keep up with malware threats.

— Lenny Zeltser

View full post on Lenny Zeltser on Information Security

Today finally I deleted her from my entire place.bt may I ever delete her from my mind ? I don’t know bt it is one thing that I must try. her behaviour towards me is becoming bad day by day. It hurts me very much. maybe she don’t have any value for me bt to me I have value for myself. the mistake I did is bring my level by making her my friend, dropping down to her level and making her my best friend is the worst mistake done by me for what I m paying for…..

She never understood me. She never tried. She always treated her own will never heard mine yet I thought of her being my one of best & trusted friends. All she does is speaking of ETHICS & VALUES of friendship bt she forgets the most important & first rule of friendship that there is no rule & no limit….

I never made her my friend nor I was after her to get my friendship back just because she is a girl ,bt she is now refusing my friendship NOW just because I m a boy.actually its her cleaver plan by making me this much irritated so that I say “ITS OVER”.and yes she won and I said that to her today.and I know she will now tell everyone that I m the one who BROKE the fridndship.just she told that I BROKE the love.huh ! amusing….

I don’t expect anyone to believe me because I hardly care for anyone.as I m no special to anyone ,no one is special to me also, well obviously with few exceptions.

I seriously don’t know why I m like this. why it is so hard for me to let anyone go. actually I have only 2 two true friend in this whole world. Others r just acquaintance…. I stop trusting anyone.as in my previous posts I told that I m on my own.

I just want to sleep a never ending sleep …

It is me Ramen Mukherjee ..signing off

It’s been a long time. I kept on thinking should I continue this blog of mine which I loved so much? Because I’m nt getting any response. For that much of thoughts, I have shared with u all for so long no responses have been received yet. And yes because my life is rather a very stagnant one. Same old routine I follow each day and at the end of it I feel my ass kicked enough to be pained.

I’m too tired these days to talk anything about my same old boring life. Nothing happened since then when I last written on this blog. Thought of much in my life gt yet so little. Meaningless life is what I’m leading right now. Nothing to loose more except ofcource my soul. Everything aroud me is nt seems to fit in, nt perfect for me, they r nt comforting me obviously if they r doing that why I m writing this god damned post here?

My social life is ruined as I feel reluctant enough not to do anything online. First factor is always the short time I get & second is my lack of true friends over net. It all seems boring. Daily group net sms & sending scrap wall tweets buzz all over the net to all. They r all shouting about same thing. The social network what I used to be habituated of was more than just doing these, that had a life now its stone cold.

There is no frill in my life and I know that I have written this line for many times. I have always kept my word given bt don’t know why I don’t like to be myself now. I like to fly away from myself. To far far away. I m sick of being no one for all. I like to be someone else. Start a new life.do something new.

Why I m so thirsty? Why I m nt satisfied? Why I want all things to be so perfect? Am I perfect? If not then why? And how I can be more perfect I don’t know… I really don’t know. yes I m very moody and sometimes very sensitive. Yes many things hurt me and I learned how to get over them bt still maybe I m nt upto the mark supressing my inner feelings for that many take advantages of it..

Why still I miss her friendship? I don’t know. Maybe really there was something between us bt yes I have came to know her true face and that is nt what I used to see, maybe that’s her mask she wore to impress me.bt her real face feels much more true to me that her previous one or her mask …and what fool I m to think of writing the entire classes for her in a copy where she already did the Xerox on her first day even I came to college. she never even bothered to ask me for any kind of help. never asked me truly how and I where I made clear to her that I MISSED HER …the most funny thing is I m criticizing her here just because I m so angry with her? Shit .,…

They say that this is my high time to make my future bt what if there is no future of this dying person? All I want it to live free for the last time.one last time I want to breathe ….i never said to them LEAVE ME ALONE though they all left me maybe I will live that long to see them ALONE. that day my friend I will laugh at them as they r doing the same to me. they mock me because I m of higher degree than them. They envy me. and that reflects nt only in their words bt in actions too. Perhaps she wants me to beg to her bt if she thinks me of spineless then it will be only her folly nt mine.

No I dnt want to share anything new. I simply don’t want to tell u about some new technology.not now.bt someday when I go to the top and u will stay at the bottom U WILL THINK that what if we all stayed with him in the time when he needed us so much.

Bt leave them as I m self made man I have walked the 20 years by my own and rest of the road I will walk alone and every time I will fall I will stand up on my own. i will never break down. i will stay strong & sharp because I know the white energy is with me. its guiding me. all the time. protecting me. surrounding me. showing me the way always. i was so blind nt to feel it for that time.bt now my soul has awaken and there is no one who can stop me. i fear no one. not even god. because I m the god of my own destiny and there is no one who is gonna take that from me.my destiny is fixed.my purpose is right. i will serve it and make my path through them to reach to my destiny. lets see what future holds for me.