On Sat, 28 Jul 2007 14:59:41 +0300, "Paul_Lucy"
>It's an antivirus program that doesn't use virus-specific information or
>database of virus signatures and hence doesn't require periodic updates. It
>looks at the different ways viruses attack.
>Here's a PDF that describes the software and it's technology (see
>"InVircible's Generic Technology" at the bottom of page 2) :
>http://www.invircible.com/papers/IV4Enterprise.pdf
"In contrast to virus-specific software, InVircible
uses no virus-specific information or database.
The methods used by InVircible are generic,
which means they are effective against groups
of threats that share a common characteristic or
behavior. Unlike virusspecific AV, which use
pattern recognition as their only detection method,
InVircible implements multiple and mutually
independent methods, simultaneously"
Well, I think several av would disagree that "pattern recognition" is
"their only detection method", though it is their main approach.
It looks like something that would compliment, rather than replace,
traditional av. I would not use it "instead of".
The underlying concepts are whitelisting (specifying what is
permitted) vs. blacklisting (specifying what is forbidden).
Traditional av works on the blacklist principle, i.e. it sets out to
detect known malware, as well as inferring malware behavior
heuristically (the part that isn't "pattern recognition").
An approach based on whitelisting would limit the system to a closed
list of acceptable programs, as befitting the locked-down corporate
desktop. That would be as popular with consumers and "free" end users
as a turd in a swimming pool ;-)
Invincible does both. Some of its generic mechanisms look like
heuristic black-listing, and to claim this will never need updating is
to predict that malware will not find new ways to behave. Other
mechanisms look like whitelisting, perhaps using the same "nag for
permission" methods as firewalls, PrevX, UAC, etc.
The trouble is, any "hard" listing approach, be it "white" or "black",
will require updates. Even if you plan to use nothing but Vista and
MS Office, you'd still have to accomodate patches that change this
code base. How will you "know" these are legitimate?
>-------------------- ----- ---- --- -- - - - -
Tip Of The Day:
To disable the 'Tip of the Day' feature...
>-------------------- ----- ---- --- -- - - - -