Share |
Malware and antivirus software

How Do You Test Anti-Virus For Unknown Virus Detection?

Created: 2006-08-16 00:00:00

Well, there's a right way and a wrong way. Unfortunately didn't know of ESET NOD32 or the right way to test for unknown viruses either.

Here is what happened.

「To pit the software against novel threats not identified on signature lists, we created 5,500 new virus variants derived from six categories of known viruses, the kind you'd most likely encounter in real life.」

How do they know that these are the kind of viruses you'd most likely encounter in real life? Do they plan to release them? I doubt it, but how do they know? They don't really.

「Our next round of tests helped us identify superior antivirus software by measuring how well each of the products identified new viruses even before their signatures had been downloaded. The antivirus programs did this by using a technique known as heuristics, in which they seek out behaviors rather than signatures.」

There are two problems with their approach. First, writing viruses for this purpose risks the accidental release of new viruses, and second, it doesn't give real world test results.

The proper way to test the heuristics of anti-virus software is called retrospective testing. This means that you take a collection of viruses discovered in a specific period of time and then scan them with scanners that were last updated before that time. For example: I could stop updating a scanner on April 30, then collect samples found between May 1 and July 31. Now when I scan I am testing to see what *real* threats that people are *really* encountering are being detected.

Back in 2001, Igor Muttik from McAfee presented a paper on retrospective testing at the Virus Bulletin Conference. (

This paper inspired Andreas Clementi ( to do just that type of testing. Andreas Marx ( also performs retrospective testing using the same principals as well. There is a good reason these highly respected test organizations test heuristics in this manner. They both know that writing viruses is not proper behavior and that retrospective testing provides scientific, real world results.

It is a pity that didn't know about the safety and scientific advantages of retrospective testing – it would have lent real world credibility to their results.




ESET NOD32®防毒軟件獲獎技術,始終位於數字安全行業的最前沿。軟件每日更新,保護用戶數據安全。


為您免費提供業內領先的本地售後技術支援。如有任何問題或查詢請在辦公時間內致電 (852) 2893 8186 查詢。