Differences between Comodo's HIPS & Other Products Intrusion Detection Systems

[Melih]

@andyman35 post:19

Are you able to discuss the methodology of the kernel level analysis that defence+ does,without giving away any trade secrets Melih?

no we can’t.
You just have to see the end result to understand all the stuff going inside to deliver that end result really…

A-VSMART architecture is much more than just heuristic or just whitelisting. At some stage we will write a technology document about it.

thanks
Melih

[andyman35]

@Luketan post:20

The Prevx approach is much more than just the use of extensive whitelists. I guess you haven’t being reading the Prevx forums? Too bad the report they released a while back on the inner working of prevx is no longer available

According to the report, and just about every claim made by their reps, the main strength of Prevx, is their behavior analysis heuristics loaded on the servers. Of course, this is what THEY claim, I have no way to verify that.

Panda’s From Traditional Antivirus to Collective Intelligence report makes a similar claim.

But then again I see in this thread Melih is making a claim about “sophisticated analysis”, though I see very little sign of that…

I’m not disputing that,I was pointing out the similar methodology with that particular facet of both products.Prevx and CFP differ widely in many ways but share one or 2 similarities.As to how effective Prevx is based upon unscientific user experience,very effective.There aren’t many controlled test results I’m aware of,just one that was linked from Wilders that gave it a mixed rating.When tested offline it was only average but when connected to the community database rated highly.

[andyman35]

@Melih post:21

no we can’t.
You just have to see the end result to understand all the stuff going inside to deliver that end result really…

A-VSMART architecture is much more than just heuristic or just whitelisting. At some stage we will write a technology document about it.

thanks
Melih

It’ll be interesting reading that I look forward to it.

[Luketan]

@Melih post:21

A-VSMART architecture is much more than just heuristic or just whitelisting. At some stage we will write a technology document about it.

Given that these are very very broad terms, you must have invented a radically new concept that no-one else in the history of computering has ever come up with. (:TNG) Somehow I doubt it.

[Luketan]

@andyman35 post:22

As to how effective Prevx is based upon unscientific user experience,very effective.

By verification , I was referring to what they claim to do, not whether it works or not.

There aren't many controlled test results I'm aware of,just one that was linked from Wilders that gave it a mixed rating.When tested offline it was only average but when connected to the community database rated highly.

Are you referring to

http://www.av-comparatives.org/seiten/ergebnisse/HIPS-BB-SB.pdf

or

http://membres.lycos.fr/nicmtests/Unhookers/unhooking_tests.htm

or something else?

[andyman35]

It was the second link that I was referring to.The results were poor (I said average remembering other tests performed elsewhere) until the community database was added to the equation.

I’m a bit confused as to the AV comparatives test,it was dated October 2006,it doesn’t seem that long since version 2 came out? Mind you time flies :THNK

[andyman35]

Thinking back it might have been out then,seems like yesterday.That’s the trouble with getting old a year is over in a blink of an eye these days. (:SAD)

[Luketan]

@andyman35 post:26

It was the second link that I was referring to.The results were poor (I said average remembering other tests performed elsewhere) until the community database was added to the equation.

Basically the community database in the 2nd test works as a standard Antivirus detetcing known malware by signature (Nicm was using well known malware samples). So I would consider the results of prevx to be poor since we are more concerned with unknown malware.

[andyman35]

Prevx is certainly much less effective if the community database is taken out of the equation,but the sheer size of that database makes unknown software uncommon.At the end of the day users have to take some responsibility for what they run on their systems,if a warning is given caution should be exercised.My personal preference is to run both Prevx and CFP3 together combining the huge database of Prevx with the seemingly superior blocking capabilities of CFP.