main

Symantec Unveils SONAR to Find Zero-Day Attacks

Slimy   on 17 January 2007 - 13:39 · 13 comments & 4555 views

Advertisement (Why?)
The Symantec Online Network for Advanced Response (SONAR) is a new security software that will analyze the behaviour of programs running on the computer and decide whether they are malicious. Although other software applications offer such features already, Symantec has stayed true to the virus definition method, until now. SONAR will be available free of charge. Well, not quite. It will be an add-on for Symantec's Norton AntiVirus 2007 and Norton Internet Security 2007 products.

"We're very excited about the release of SONAR. It's zero-day protection that doesn't rely on threat signatures," said Ed Kim, director of product management with Symantec's consumer business unit.

Zero-day attacks are threats that expose undisclosed or unpatched software vulnerabilities. SONAR uses an algorithm to evaluate hundreds of attributes relating to software that is running on the computer. The software is built on WholeSecurity technology, a company Symantec acquired 2005. Symantec also currently offers Critical System Protection, which is a similar program to SONAR but for the Enterprise market. According to Symantec, such software is finally ready for the consumer desktop market.

"Signature-based technologies for viruses and spyware certainly work, but their coverage is increasingly thin. So you need to bolster signature-based approaches with behavior-based approaches," said Andrew Jaquith, senior analyst with Yankee Group Research.

News source: InfoWorld

Post a comment · Send to friend Comments · There are 13 additional comments
(2 replies) #1 +Shadowdruid on 17 Jan 2007 - 13:55
Quote -
Signature-based technologies for viruses and spyware certainly work, but their coverage is increasingly thin. So you need to bolster signature-based approaches with behavior-based approaches," said Andrew Jaquith, senior analyst with Yankee Group Research.


I thought herustic scanning was enabled for like almost all AV now days

Bitdefender creates a mini OS and scans all files in it to check for any virus like behaviour.
#1.1 RootWind on 17 Jan 2007 - 14:09
I'm under the impression that SONAR is a HIPS, and will prompt the user if a program is about to do something suspicious. Heuristics on the other hand are tuned to be able to detect malicious behavior while not having false positives. Since a lot of malicious programs act like normal programs, heuristics won't be able to reliably tag malware. Also, VM based heuristics have also begun to be "broken out" of by malware.
#1.2 +Shadowdruid on 17 Jan 2007 - 14:13
Quote - (RootWind said @ #1.1)
I'm under the impression that SONAR is a HIPS, and will prompt the user if a program is about to do something suspicious. Heuristics on the other hand are tuned to be able to detect malicious behavior while not having false positives. Since a lot of malicious programs act like normal programs, heuristics won't be able to reliably tag malware. Also, VM based heuristics have also begun to be "broken out" of by malware.


Ah ic now. Thanks for clearing that up.
#2 alister on 17 Jan 2007 - 14:49
Free but you have to buy NAV 2007 or NIS 2007.

This is free without having to install Symantec crap on your computer - Cyberhawk
(1 reply) #3 +Kushan on 17 Jan 2007 - 14:53
free or not, installing Norton antivirus is too high a price to pay and I'm not talking about money.
#3.1 Lare2 on 17 Jan 2007 - 18:13
Quote - (Kushan said @ #3)
free or not, installing Norton antivirus is too high a price to pay and I'm not talking about money.


LOL I like the way you say it. O totally agree, the price to have that POS is to high
#4 Jugalator on 17 Jan 2007 - 15:00
Now, let's see if Symantec can push a feature rich antivirus tool under the 50 MB barrier. :-p

A much greater challenge, it seems...
(2 replies) #5 leesmithg on 17 Jan 2007 - 16:52
I look at it in this light, would you rather have a big bad hard looking man that is as hard as a coffin nail protecting you, or a small podgy boy that enjoys a windy walk?

I prefer the former than the latter.
#5.1 raskren on 17 Jan 2007 - 18:36
Uh, was that supposed to be homoerotic?
#5.2 +Shadowdruid on 18 Jan 2007 - 06:29
Quote - (raskren said @ #5.1)
Uh, was that supposed to be homoerotic?


ROFL!!!
#6 wrack on 17 Jan 2007 - 21:42
Zone Alarm Security Suite is enough for me at the moment. I was a hardcore Norton Antivirus fan for 5 years until it started screwing things up with 2005 and later editions
#7 ahhell on 17 Jan 2007 - 22:37
I wonder how many extra services that app installs. I guess 20 isn't enough.
#8 ]SK[ on 18 Jan 2007 - 07:24
Every computer I come across that's running a Symantec scanner runs slow. Uninstall and you boost its performance by 50%. Corp Edition though seem's better.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)