Slashdot Mirror
Google Uses Reputation To Detect Malicious Downloads
CowboyRobot writes "Using data about Web sites, IP addresses and domains, researchers find that they can detect 99 percent of malicious executables downloaded by users, outperforming antivirus and URL-reputation services. The system, known as Content-Agnostic Malware Protection or CAMP, triages up to 70 percent of executable files on a user's system, sending attributes of the remaining files that are not known to be benign or malicious to an online service for analysis, according to a paper (pdf) presented at the Network and Distributed System Security Symposium (NDSS) in February. While the system uses a blacklist and whitelist on the user's computer to initially detect known good or bad files, the CAMP service utilizes a number of other characteristics, including the download URL, the Internet address of the server providing the download, the referrer URL, and any certificates attached to the download."
Google, we want to scan your computer for you too. All that other stuff we find ... you know, the personal stuff or the illegal downloads or copyrighted stuff ... we promise not to see it.
It is interesting to see how karma works in the business world. Microsoft has been doing this for quite some time, with a few differences in implementation. But when Microsoft does it, we see that they are spying on us. When Google plays catch up, it grabs headlines for fighting malware.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
It's only in Windows 8, but Microsoft does the same thing.
1% of false negatives is good, but how about false positives?
The state you are in while your HEAD is detached... - wait, what?
You've lost some weight.
ha ha you nailed them to the wall m but i think the animosity( did i spell that right?) you are thinking yolu may be experiencing is prololy due to the MASSIVE SPAM WAR YOU BROUGHT HERE FROR US TO ENJOY AD INFINITUM
other than that you were correct
http://tot-ltd.org/techinf.html
NSRL is also a pretty good site to get a comprehensive whitelist from. Best of all, the whitelist database is free, and used for forensic file analysis. The only mildly difficult part is sometimes keeping up with the release of new malware, but that's why I implement several other databases, including one based on API calls in known hostile applications. The really interesting thing with API groups, is that you can identify which piece of new malware most likely belongs to a specific family. So far, I've had no false positives on whitelisted files checked against the API database. ( http://www.tot-ltd.org/API )
take another look at that... it looks like he was replying to it...
Tell us, Peter, by trolls, do you mean the OTHER people in your head?
Theoretically, distributing software using a self-signed certificate, as is done on Android, would create a "key continuity" situation that would allow "the reputation of the file [to] follow the reputation of the key". But I was under the impression that the warnings for downloading software with a self-signed certificate were even sterner than the warnings for distributing completely unsigned software. So what should a hobbyist software developer do to avoid a recurring fee of $100 to $200 per platform per year?
You are the most consistently annoying creature on the internet. There are people worse than you, just like cancer is worse than psoriasis, but you're more like the latter: pervasive, annoying, and always cropping up when one has mostly forgotten about it. You are that indeterminate, continuous itching that slowly erodes someone's mood until they consider cutting off a part of themselves just to stop it for a while.
And like psoriasis, you're auto-immune and not fully understood by science. Slashdot continuously makes it worse by scratching that itch over and over again. It's not smart. It just encourages the disease. But everybody's got a limit to their patience.
There is no cure for you. But at least, when slashdot dies, you will die with it, and there will be peace.
Why do you talk about yourself in the third person sometimes?
You think the death of Slashdot will stop APK? He's been doing this on Usenet & later on various tech websites for at least 20 years. Not even 4chan is safe. He's not just a troll, he's discovered a power level beyond trolling.
We know it's you doing those spam posts http://slashdot.org/comments.pl?sid=3581857&cid=43276741 and you fail at disproving apk's points that custom hosts files can give users of them better speed, security, reliability, and even anonymity to a degree here http://tech.slashdot.org/comments.pl?sid=3626185&cid=43390539
Why're you so off topic?
You boys can't seem to: You can't validly disprove apk's points http://tech.slashdot.org/comments.pl?sid=3626185&cid=43390539 on how hosts files can give users more speed, security, reliability, and even anonymity to an extent online. The only "power level" apk has discovered is how to make you act the fool stumbling around trying to get the better of him and you fail it.
http://tech.slashdot.org/comments.pl?sid=3626185&cid=43401051
* :)
APK
P.S.=> Face facts, & accept 1 thing: YOU are far too technically weak to EVER "get the better of me" (and you know it, I know it, + so does anyone else reading with 1/2 a brain... & all your unjustifiable downmods that can't disprove that custom hosts files yield better online speed, security, reliability, + even anonymity (to an extent) for end-users of them, as I stated here http://tech.slashdot.org/comments.pl?sid=3626185&cid=43390539 which "the trolling likes of you" are clearly unable to disprove validly on computing-tech based grounds... you, FAIL!)
... apk
You just plain LOST vs. myself, long ago -> http://tech.slashdot.org/comments.pl?sid=3626185&cid=43401051
* :)
(Since you're clearly unable to disprove my points on custom hosts files being of value to end-users of them for better online speed, security, reliability, & even anonymity to an extent as well...).
LMAO - no, instead, you show us that "the best you got" = zero in unjustifiable downmods & NOT disproving my points on a computing tech level... period!
APK
P.S.=> Face facts, & accept 1 thing: YOU are far too technically weak to EVER "get the better of me" (and you know it, I know it, + so does anyone else reading with 1/2 a brain... & all your unjustifiable downmods that can't disprove that custom hosts files yield better online speed, security, reliability, + even anonymity (to an extent) for end-users of them, as I stated here http://tech.slashdot.org/comments.pl?sid=3626185&cid=43390539 which "the trolling likes of you" are clearly unable to disprove validly on computing-tech based grounds... you, FAIL!)
... apk
Jeremiah Cornelius spammed this all March 2013 http://slashdot.org/comments.pl?sid=3581857&cid=43276741 , and was caught in that link, by mistakenly submitting that as his registered user account instead of his usual 100's of ac submittals of it he did. This shows us all how weak trolls like JC are against facts apk put out in favor of custom hosts files gaining users of them added speed, security, reliability, and even anonymity as well as those same trolls frustration at being defeated so easily by apk every single time since they are unable to validly disprove apk's points (to the point of all trolls have is computing technically unjustifiable downmods & failed illogical off topic ad hominem attacks, nothing more). Jeremiah Cornelius = pitiful (and weak).
Shut up, Paul.
Shut up, Paul.
Shut up, Paul
Shut up, Paul
SHUT UP, PAUL
SHUT UP, PAUL
SHUT UP, PAUL