Malware Has Gotten Smarter. Here's How Your Antivirus Has, Too

Antivirus software is undergoing a major shift. Traditionally, antivirus software relied on matching files against databases of known malware signatures. But today's threats evolve too quickly for databases of known malware signatures to keep up reliably.

It might be helpful to think of it like this: Old antivirus software worked like a nightclub bouncer with a stack of photos of bad actors behind the counter. If a file matched a known malware signature, it got tossed out. If it didn’t, the bad actor usually walked right in wearing sunglasses and a fake mustache.

But now the software is monitoring behavior rather than just checking names at the door. To expand their predictive capabilities, many modern antivirus platforms are increasingly relying on machine learning, behavioral analysis and real-time monitoring to identify suspicious activity before a threat has been fully classified.

That means that, instead of only identifying known malware after it appears, efficient antivirus software can spot suspicious behavior before the threat fully executes or spreads across a system.

Here, we break down exactly how modern antivirus software works and give some tips for finding the right security services for you.

Antivirus software used to look for known threats

Since the early days of personal computing, antivirus software mostly worked through recognition. Security companies studied malware, carved out unique signatures for known threats and pushed those updates out to users.

Your antivirus software was programmed to scan files and compare them against the database. If something matched, the alarm went off. The system worked reasonably well as long as security companies could keep malware databases up to date quickly enough.

Yet bad actors treat code like a moving target, and malicious software has been developed faster than the models built to stop it.

For example, polymorphic malware, which changes parts of its code every time it spreads, avoids looking identical in each infection. Metamorphic malware rewrites its own code so each version appears substantially different from the last. Zero-day attacks target newly discovered software vulnerabilities before security vendors have time to create protections or updates.

... continue reading