Antivirus Software

Article Info

Contributed by
2 authors

Last updated on
2022-12-30 10:44:11

Internet Security
Firewall
Sandboxing
Malware
Rootkit
Threat Modelling

Article Versions

8 2022-12-30 10:44:11
3886,3885 8,3886

By arvindpdmn

Improving readability. Correcting grammar.
7 2022-12-30 10:01:47
3885,3884 7,3885

By arvindpdmn

Mainly formatting corrections. Adding missing details or corrected refs. See Also updated.
6 2022-12-25 16:05:51
3884,3879 6,3884

By Govindpathak

Implementing final review changes
5 2022-12-21 04:08:11
3879,3877 5,3879

By Govindpathak

Implemented all the review changes
4 2022-12-15 12:32:54
3877,3874 4,3877

By Govindpathak

Adding citation to some milestones and removed incompatible see also items

Chat Room

Submitting ...

You are editing an existing chat message.
2022-12-30 10:49:27
-

By arvindpdmn

1. Article could have used better source references. Although 45 refs have been used, most are not technical papers or popular sites.
2. Some repetition of data could be avoided.
3. Architecture: covers only signature-based method. Can be rewritten in a more generic manner to cover all methods. Current answer also depends on a single source.
4. Currently, the article is for the general reader but may not benefit developers or system admins that much. A couple of more "hands-on" questions can improve the article.
2022-12-25 16:11:40
-

By Govindpathak

All of the rest changes have been done.
2022-12-25 16:11:18
-

By Govindpathak

Alternative question: I think the security software suites para is giving the overview while alternative question describes the other options in detail. Still, would be happy to change it in a better manner. Please let me know how to present it.
2022-12-25 16:07:11
-

By Govindpathak

Couldn't find any other article or content on architecture of antivirus software.
2022-12-25 05:33:11
-

By arvindpdmn

0. Second and final review.
1. With many answers, formatting can be improved. Use list formatting rather than sub-headings. Sub-headings may work in Wikipedia but not in Devopedia where short answers are expected. In some cases, no sub-headings are needed if content is separated into paragraphs and keywords are in bold. Overall, readability will improve by doing it this way.
2. "Network Firewall": wrong formatting. Always do a self-review before submitting for review.
3. Answer on architecture without a block diagram? Image is needed here. Entire answer depends on a single citation, Han et al. 2022. One more citation is needed so that we can be confident answer is correct.
4. Did Tomlinson create Reaper? The cited source is not clear on this point. 1981 milestone is not relevant: this article should focus on antivirus rather than virus itself. Did anyone create an antivirus for Elk Cloner? Likewise, many other milestones have to be updated to focus on the antivirus. 2000 milestone is good since it's about antivirus. There will be a separate article on viruses.
5. Summary changes: reorganize the info. Since you're explaining what's a virus or malware, do this first. Then introduce antivirus.
6. Alternatives question: I don't know if this is the right way to present this info. Isn't all this done by "Security Software Suites" introduced in an earlier question? See how it can be improved.

Malicious software or malware are code that can harm computer systems and steal personal information, causing severe damage such as financial loss. These malware can enter through various ways including as an email attachment, on a USB drive, or user visiting infected websites or clicking malicious links.

Antivirus software is a program that protects computer systems from malicious software. Antivirus software needs privileged access to the system to function properly. Many antivirus software provide real-time threat protection against harmful applications. It's also possible to manually perform security scans.

It's advisable to use antivirus programs on desktops. They can be optional in mobile phones if users don't download any app from unofficial sources or click suspicious links.

Discussion

What are the features of an antivirus software?
Below are some common features of an antivirus software:
- Real-time scanning: Antivirus software that do security checks while using the system are real-time scanning software.
- Quarantine: An isolated place where harmful files are kept.
- Bank mode: A feature that provides a clean and safe virtual environment within the real desktop environment.
- Ransomware Shield: Secures personal photos, documents, and other files from being modified, deleted, or encrypted by ransomware attacks.
- Remote Access Shield: Protects the computer from remote and unauthorized access.
- Sandbox: A sandbox is a system in which suspicious files are tested and analysed inside a virtual machine to detect malware.
- Hack alerts: Warns if sensitive data is leaked on the Dark Web and other online sources.
- Password protection: Protects passwords stored in web browsers.
- Webcam shield: Restricts applications and malware from gaining unauthorized access to the webcam.
- Masking IP address: Hide the IP address while browsing internet.
- Freemium vs Paid versions: Basic features with free versions. More features with paid versions.
What are the types of antivirus programs?
Standalone antivirus software are specialized to scan and remove certain viruses. They can easily be carried from one place to another in a USB drive. These type of antivirus programs do not provide real-time protection. Windows defender offline, Metascan client and Microsoft scanner are some examples.
Security software suites provide more security features than antivirus software. They not only scan and remove the viruses but also protect from other malicious attacks. They provide complete protection to the user's computer. They include extra security features such as anti-spyware, firewall, site authentication and parental controls. Bitdefender Total Security, Norton 360 Deluxe, and Kaspersky Total Security are some of its examples.
Cloud-based antivirus software analyse the files on the cloud instead of on the user systems. They have two parts: (a) client side that's installed on user systems; (b) cloud side that captures the data gathered from client side and runs the scans. The latter saves a lot of memory and resources on user computers.
What's the architecture of antivirus software?
Architecture of signature-based antivirus. Source: Madhavi 2022.
An antivirus software consists of four main components namely Anti-virus Manager, Anti-virus Engine, Malware Signature Database and Anti-virus Driver.
The Anti-virus Manager handles overall management functions. It's responsible for executing malware scans, reviewing the results of malware restoration, raising alarms, and setting a periodic scan policy for malware. It updates the Malware Signature DB and the Anti-virus Engine.
The Anti-virus Engine is responsible for handling malware in the system. It analyses the file information and marks it safe or harmful based on the scanning.
In the Malware Signature Database, signatures of malware are kept. The antivirus engine evaluates the suspicious file by comparing its characteristics to these signatures.
The Anti-virus Driver is a real-time malware entry monitoring function that revokes access to malware-infected user files. It checks the input and output of the file and determines the exact file path to check for malware.
Which are major virus detection methods used by antivirus software?
There are mainly two virus detection techniques used by antivirus programs namely Heuristic-based detection and Signature-based detection.
In signature-based detection, the antivirus software scans the files and compares it with the predefined malicious code present in its database. The signature could include malicious network attack behaviour, content of email subject lines, file hashes, known byte sequences or malicious domains. If a file matches any malicious code, it flags it as virus and takes necessary actions. The antivirus can't detect any new malware or even any updated variant of malware that is not written in definition file. With rapid growth in variants of malware, this detection method becomes ineffective in long run.
In heuristic-based detection the antivirus software uses data mining and machine learning techniques to learn the behaviour of an executable file. For instance, it may detect commands to deliver payloads disguised within a Trojan horse virus or those used to distribute a worm virus. It's able to identify new or altered variants of malware even in the absence of updated malware code in the database. It's commonly used in combination with signature-based detection.
What are other virus detection techniques used by antivirus software?
Behavioural-based detection analyses every single line of code in the file before its execution. If it finds the objective of the file suspicious or harmful (such as taking access to any critical or irrelevant files, processes, or internal services) it flags it as malware. Degree of potential danger is calculated by the antivirus software and required actions are taken afterwards. Some examples of malicious behaviours include any attempt to discover a sandbox environment, disabling security controls, installing rootkits, and registering for autostart.
Sandbox is a system for malware detection that runs any suspicious object in a virtual machine (VM). If the object performs malicious actions in VM, the sandbox registers it as malware. VMs are isolated from the real system.
Cloud-based detection identifies malware by collecting data from host computers and analysing it on the provider's infrastructure, instead of performing the analysis locally on the system. It's done by capturing relevant details about the file and the context of its execution and providing them to the cloud engine for processing.
What are the differences between server, desktop and mobile antivirus software?
Most antivirus software are built for desktops, specially Windows as it has the largest user base. Many antivirus software vendors offer their product at different price ranges, starting with free version which offer only basic protection. These free versions often don't protect against malicious attachments in emails, fishy website links and other type of cyber attacks. Microsoft offers a basic free antivirus software with Windows known as Windows Defender.
Mobile antivirus software differ than the desktop ones as they have less access and control over the host device. Mobile antivirus software can't do OS file access, website filtering, in-memory scans or real-time protection engines. Android users need antivirus software more than the iOS users as iOS devices have better security features.
A good server antivirus software detects virus before it infects the system. It also stops data transfer between server and external drives. It defends information on servers from every kind of malicious applications. It provides security for different server subsystems such as email, firewall and proxy.
What are the challenges faced with an antivirus software?
One of the biggest challenges faced with antivirus software is that it slows down the computer. Antivirus software loads each time when the system boots up which makes booting slower. Without a powerful processor and a good amount of memory, antivirus software can slow down systems to a high extent.
No antivirus software provide 100% security from all kinds of cyber threats. Inexperienced users might fall into a false assumption of being completely secure. If the antivirus uses heuristic detection, it might flag harmless websites and software as malicious.
Antivirus software runs at the kernel level of the operating system. It has privileged access to all the core files of the OS and system. Hence it becomes a potential target for cyber attacks. The US National Security Agency (NSA) and the UK Government Communications Headquarters (GCHQ) intelligence agencies have been exploiting anti-virus software to spy on users. In fact, it's been noted that popular software such as Acrobat Reader, Microsoft Word or Google Chrome are harder to exploit than 90% of the anti-virus products.
Are there any alternatives of antivirus software?
The command-line rkhunter scanner, an engine to scan for Linux rootkits running on Ubuntu. Source: Nanni 2020.
Below are some alternatives of antivirus software:
- Network firewall: Network firewalls stop unknown programs and processes from accessing the system but unlike antivirus programs, they don't identify or remove any virus present in the system. They provide safety from malware coming from other websites on a network.
- Cloud antivirus: Cloud antivirus offer features like other antivirus programs but rely on cloud to process malware. They're faster than usual antivirus software as it does most of its computing on the cloud. Due to up-to-date database of malware and viruses they can find new versions of malware. Panda Cloud Antivirus and Immunet are examples of cloud antivirus.
- Online scanning: Some antivirus vendors provide websites that offer free scanning of system. These can be used without downloading heavy software in local systems.
- Specialized tools: Virus removal tools are helpful in removing stubborn/sticky viruses. Avast Free Anti-Malware, AVG Free Malware Removal Tools and Avira AntiVir Removal Tool are some examples of such tools.

Milestones

1971

The first known virus named as Creeper Virus is discovered. It infects DEC PDP-10 mainframe computers running the TENEX operating system. Ray Tomlinson writes a program to delete creeper virus. This program is known as The Reaper. Some people consider the Reaper as the first antivirus program but Reaper is itself a virus made to remove the Creeper Virus.

1987

Bernd Fix becomes the innovator of first antivirus product. However, there are competing claims for it. John McAfee establishes the McAfee company. Peter Paško, Rudolf Hrubý, and Miroslav Trnka create the first version of NOD antivirus. The first two heuristic antivirus utilities are released: Flushot Plus by Ross Greenberg and Anti4us by Erwin Lanting.

2000

Rainer Link and Howard Fuhs start the first open-source antivirus engine called OpenAntivirus Project.

2001

Graphical front-end of ClamTk Antivirus. Source: Linux Mint 2022.

Tomasz Kojm releases the first version of ClamAV, the first ever open-source antivirus engine to be commercialised.

2005

AV-TEST (a German based independent organization) reports that there are 333,425 unique malware samples in their database. In 2007 alone, AV-TEST reports 5,490,960 new unique malware samples.

2008

McAfee Labs adds the industry-first cloud-based anti-malware functionality to VirusScan (an antivirus) under the name Artemis.

2010

A faulty update on the AVG anti-virus suite damages 64-bit versions of Windows 7, rendering it unable to boot, due to an endless boot loop created. If not properly managed, this highlights the danger of antivirus programs since they have privileged access.

2011

Microsoft Security Essentials (MSE) removes the Google Chrome web browser, rival to Microsoft's own Internet Explorer. MSE flags Chrome as a Zbot banking trojan. In 2017, Google Play Protect on Moto G4 flags a Bluetooth system app as malware, causing Bluetooth functionality to become disabled for all apps. In 2022, Microsoft Defender flags all Chromium-based web browsers and Electron-based apps (Whatsapp, Discord, Spotify) as a severe threat. There are some examples of false positives.

References

Article Stats

1850

Words

Authors

Edits

Chats

Likes

1210

Hits

Cite As

Devopedia. 2022. "Antivirus Software." Version 8, December 30. Accessed 2023-11-12. https://devopedia.org/antivirus-software

Contributed by
2 authors

Last updated on
2022-12-30 10:44:11

security system websecurity

Internet Security
Firewall
Sandboxing
Malware
Rootkit
Threat Modelling

Antivirus Software

Discussion

Milestones

References

Further Reading

Article Stats

Author-wise Stats for Article Edits

Cite As

See Also

Login