As the paper pointed out, this approach “amortizes the transmission and analysis cost over the time elapsed between file creation and system or user-initiated access.” The idea of sending a file for analysis even before it is being used was described earlier in the CloudAV: N-Version Antivirus in the Network Cloud paper by Jon Oberheide, Evan Cooke, and Farnam Jahanian. Files that have been downloaded, but not yet opened can be asynchronously scanned later when the system is idle. Programs that are about to be launched need to be analyzed before execution occurs. This redundancy of scans results in a degradation of user experience…" In each layer, each object is scanned by multiple technologies, such as antivirus signatures, rules, heuristics, behavioral analysis, etc. "Traditionally AV engines have intercepted files and objects in multiple layers (entry vector, file system and execution). Panda Cloud Antivirus attributed performance improvement in their product to such redesign:
To further improve performance, the agent can be more intelligent about how it intercepts file access prior to scanning. Instead of having to assess whether a file is malicious by performing analysis locally, the agent captures the relevant details from the endpoint and provides them to the cloud engine for processing. This implies that cloud anti-virus imposes less strain on the system's resources. Improving System Load with a Lightweight AgentĬloud anti-virus employs agent software on the protected endpoint that is much lighter than the installed components of traditional anti-virus tools. I believe this definition is consistent with the description, capabilities and architecture of most cloud anti-virus products. I haven't been able to locate an authoritative definition of cloud anti-virus, so I humbly propose my own:Ĭloud anti-virus is anti-malware technology that uses lightweight agent software on the protected endpoint, while offloading the majority of data analysis to the provider's infrastructure. Anti-virus companies are increasingly highlighting cloud-based capabilities of their products, extolling benefits such as "the speed of cloud computing to deliver real-time protection." What does that mean? What is cloud anti-virus anyway? Let's examine the key characteristics of cloud anti-virus products, surveying the technology while attempting to cut through the hype.
0 kommentar(er)
