RSA 2013 Signature-based malware identification has been around since the dawn of the computer security industry, but McAfee has said it's dumping the system – or rather, adapting it – in an upgraded security suite which will (it claims) virtually eliminate susceptibility to botnets.
McAfee's malware signature database has grown to over 113 million core samples in the last year. But rather than using just that data to spot malware, McAfee has now integrated behavioral heuristics into its security code so that it can spot unknown samples based on their operating characteristics. The end result could crush botnets as a threat, said the company's GM of network security, Pat Calhoun.
"We're getting rid of malware signatures, all our systems now work on behavior and reputation," he said. "Customers no longer have to worry about botnets; we will take care of that for them. We can catch things that no one else can in the industry."
Calhoun told The Register that when Intel took over McAfee in 2010, Chipzilla put extra funding into countering the threat from botnets. As a result, it now has the ability to search specifically for command-and-control server code, as well as the malware that brings new computers into the botnet fold.
In all, McAfee says it has made 38 new improvements to its security suite, and integrated its various modules much more tightly with each other. Integration of security products into a single unified suite has been the goal of the large security vendors for years, but this time McAfee thinks it has cracked it.
"You can’t take a set of tools, codify a few marketing relationships, and expect it to work," explained McAfee CTO Mike Fay. "We have 150 such relationships and you need to merge them into a system. We've done this and over the next three years you're going to see more innovation as a result than in the last 10 of McAfee's history."
Mac and PC users on Chipzilla's hardware will get an advantage, of course, since McAfee's Deep Defender relies on Intel's kit for much of its efficacy. Fay said it would look at market demand and some technology rejiggering before it would integrate with AMD chips.
As for rootkits – a particular Intel bugbear – McAfee touted a recent test by AVLabs that it sponsored that highlighted the effectiveness of part of its suite at cutting this attack vector short (although it did not specify testing criteria). The tests give McAfee a 100 per cent rating at killing rootkits, compared to 83 per cent for Microsoft and 67 per cent for Symantec.
McAfee also announced it has bought in sandboxing technology from ValidEdge, which runs malware samples in a virtual machine to test their effects on Windows and other systems without letting it loose on the operating system. The first products using the technology will be out in the second half of this year. ®