CloudAV: N-version antivirus in the network cloud

摘要: Antivirus software is one of the most widely used tools for detecting and stopping malicious unwanted files. However, long term effectiveness traditional host-based antivirus questionable. fails to detect many modern threats its increasing complexity has resulted in vulnerabilities that are being exploited by malware. This paper advocates a new model malware detection on end hosts based providing as an in-cloud network service. enables identification multiple, heterogeneous engines parallel, technique we 'N-version protection'. approach provides several important benefits including better software, enhanced forensics capabilities, retrospective detection, improved deployability management. To explore this idea construct deploy production quality system called CloudAV. CloudAV includes lightweight, cross-platform host agent service with ten two behavioral engines. We evaluate performance, scalability, efficacy using data from real-world deployment lasting more than six months database 7220 samples covering year period. Using dataset find 35% coverage against recent compared single engine 98% rate across full dataset. show average length time 48 days can greatly minimize impact delay. Finally, relate case studies demonstrating how capabilities were operators during deployment.