Application Whitelisting

Antivirus Software

How an antivirus based on the blacklisting principle works

An important component of a security concept is an effective antivirus. But how does it work? Basically, there are different approaches to the development of modern antivirus programs. Which type of antivirus is best for you depends on a number of factors. But when making your decision, you should first be aware of the different ways in which the software solutions work.

Classic antivirus programs are often blacklist solutions and work with a negative list. In addition, a heuristic analysis of the behavior of suspicious software derived from a sandbox is also now commonly used – in principle, the advertising promises that's how previously unknown malware can also be successfully detected. Unfortunately, the antivirus often struggles to tell the difference between legitimate software's behaviors and that of malware, which purposefully tries to throw off the heuristics. In reality, either most malware manages to successfully masquerade as legitimate software, or lot of legitimate software gets hit with false positive detections. All email attachments, new programs, addresses, targets, files from external drives, etc. are examined with high scrutiny and any new files suspected of being untrustworthy trigger an alert. This may cause alert fatigue in users, which results in users already expecting the alert before it even pops up, ready to just dismiss it without further thought – even those that were actual threats.

In other words, this type of antivirus only reliably detects malware that it already knows about. Unknown malware often remains undetected and can enter the system unhindered. This has become an ever-increasing problem simply because malware authors know about that weakness and new malware is emerging on a daily basis to exploit it. Conventional antivirus software therefore simply cannot guarantee dependable protection anymore.

The attempt to compensate for this problem usually consists of costly (both in terms of finances, and system resources) extensions such as deep learning malware detection, anti-ransomware and anti-exploit technology, although their reliability in terms of detecting new malware is equally questionable. The results are extremely complex defense strategies that are increasingly difficult to harden against cyberattacks due to their many points of failure, while at the same time being hard to keep track of for companies in terms of their functionality vs cost and time invested. In day-to-day operations, it is highly valuable to be able to simply trust the antivirus to do its job reliably, without the need for any major intervention. For this reason, whitelisting concepts have established themselves as a dependable alternative for a common antivirus program.