Symantec began with SONAR and continues to research behavior-based defenders

Jun 9, 2007 12:14 GMT  ·  By

Symantec has unveiled the free beta version of the Norton AntiBot, which is a behavioral-based defender built to detect and remove in real time the threats that could have been missed by the traditional antivirus products. The beta version of the Norton AntiBot will run only on Windows XP and Vista.

Symantec`s director of product management, Ed Kim, has stated that the stand-alone AntiBot will be launched next month, replacing this beta version. So far the Norton AntiBot is considered to be a supplement to antivirus software and not a replacement.

Based on both the Symantec`s SONAR behavioral scanning technology and Sana Security Inc.`s technology, the AnitBot will be different from most of the antivirus products. The other antivirus software are usually relying on fingerprint-like signatures. The AntiBot is a behavioral-based defense which will monitor the PC in order to detect proofs of weird conduct. This kind of utilities, the behavioral-tools, search for events like changes to a system file or unexpected writes to the Windows registry. These tools are known to represent the best defense against the ever-increasing botnets.

Anyway, the Antibot will not only search for bot malware, but also for other malicious software, like keystroke logging. The name of the product might make many think it is designed only for bot scanning and removal, but it is only a result of the Symantec`s acknowledgement for the fact that the botnets have an important impact on consumer perceptions.

So far this product can be downloaded from Symantec`s site and it has an extendable 15-day trial period.

This latest defense product shows that security companies are interested in developing products and technologies that rely on different methods than the ordinary signature-matches in detecting malware. And that`s justified by the continuous development of malware in order to evade signature detection.