caro2010 avtest presentation useful and useless statistics ...
Post on 03-Apr-2022
3 Views
Preview:
Transcript
Useful and useless statistics about viruses and anti-virus programs
Dipl.-Ing. Maik Morgenstern and Hendrik PilzAV-Test GmbH, Magdeburg, Germany
Presented at CARO 2010 Helsinki
http://www.av-test.org
Agenda
• Disclaimer• The Average Anti-Malware Product• The Average Malware• A Typical Day in Anti-Malware Industry• (Serious and not so Serious) Implications• Conclusions• Q&A
Disclaimer
• Not necessarily a scientific presentation• Bases on data from AV-Test only• May not be representative• We are just talking about numbers• We are not claiming anything and we could
be wrong with what we say• Still, some numbers may be interesting
The Average Anti-Malware Product2005 2010
Installer Size 12,6 MB 69,6 MBSize on Disk 87,9 MB 265,5 MBNumber of Signatures 104.509 3.666.872Size of Signature File 7,7 MB 84,4 MBPrice 45 € 32 €Updates per Day 2 6WildList Detection (virtually) 100% (virtually) 100%Zoo Detection 93,04% 91,59%False Positives 0,03% 0,00157%
The Average Anti-Malware Product
Signature file9%
Other components
91%
2005
Signature file32%
Other components
68%
2010
0
50
100
150
200
250
300
2005 2010
In M
B
Size on Disk
Size of signature file Size of other components
The Average Anti-Malware Product
104.509
3.666.872
0500.000
1.000.0001.500.0002.000.0002.500.0003.000.0003.500.0004.000.000
2005 2010
Number of Signatures
7,7
84,4
0102030405060708090
2005 2010
In M
B
Size of Signature File
050100150200250300350400
0500.000
1.000.0001.500.0002.000.0002.500.0003.000.0003.500.0004.000.000
2005 2010
Number of Signatures vs. Size of Signature File
Number of Signatures Size of signature file
The Average Anti-Malware Product
2010
Up-To-Date Information: http://www.av-test.org/numbers.php
The Average Anti-Malware Product
80,00%
82,00%
84,00%
86,00%
88,00%
90,00%
92,00%
94,00%
96,00%
98,00%
100,00%
06.0
6.20
0706
.07.
2007
06.0
8.20
0706
.09.
2007
06.1
0.20
0706
.11.
2007
06.1
2.20
0706
.01.
2008
06.0
2.20
0806
.03.
2008
06.0
4.20
0806
.05.
2008
06.0
6.20
0806
.07.
2008
06.0
8.20
0806
.09.
2008
06.1
0.20
0806
.11.
2008
06.1
2.20
0806
.01.
2009
06.0
2.20
0906
.03.
2009
06.0
4.20
0906
.05.
2009
06.0
6.20
0906
.07.
2009
06.0
8.20
0906
.09.
2009
06.1
0.20
0906
.11.
2009
06.1
2.20
0906
.01.
2010
06.0
2.20
1006
.03.
2010
Detection Rates in AV-Test Collection Scan
Average
Median
The Average Malware2005 2010
Size 180 KB 486 KBFile Type PE PEMalware Type Trojan TrojanPacked by … UPX Custom PackerDetected after … 10-12 hours 2-4 hoursDetected as … Same Family Several Different Names
The Average Malware
File Types 2005 20101. PE Files PE Files2. HTML/PHP/JavaScript HTML/PHP/JavaScript3. Batch File/Scripts PDF/Flash/Images
The Average Malware
Custom Packer35%
UPX29%
AsPack11%
NullSoft5%
PE Compact3%
Themida2% Others
15%
Packers used in 2010
UPX31%
FSG14%PE Compact
10%
Morphine6%
AsPack5%
NsPack4%
uPack5%
Others25%
Packers used in 2005
The Average Malware
Trojan35%
Backdoor28%
Virus18%
Worm14%
Others5%
Malware Types in 2005
Trojan52%
Worm11%
Backdoor8%
Downloader8%
Rogue Application
6%
Others15%
Malware Types in 2010
A Typical Day in Anti-Malware Industry2005 2010
Signature/Program Updatesper Day 110 574per Month Over 3.400 Over 17.000per Year Over 40.000 Over 200.000
Size of the Updatesper Day 1,2 GB 17 GBper Month Over 30 GB Over 500 GBper Year Over 400 GB Over 6.120 GB
New Malwareper Day 360 Over 50.000per Month Over 10.000 Over 1.500.000per Year Nearly 130.000 Nearly 20.000.000
A Typical Day in Anti-Malware Industry
0
5
10
15
20
25
30
35
2005 2010
In M
B
Size per Update
02468
1012141618
2005 2010
In G
B
Size of Updates per Day
0
100
200
300
400
500
600
700
2005 2010
Number of Updates per Day
A Typical Day in Anti-Malware Industry
0100.000200.000300.000400.000500.000600.000700.000800.000900.000
1.000.0001.100.0001.200.0001.300.0001.400.0001.500.0001.600.0001.700.0001.800.000
New Unique Samples Added to AV-Test.org's Malware Collection
Growth 3 Month Median
A Typical Day in Anti-Malware Industry
0
5.000.000
10.000.000
15.000.000
20.000.000
25.000.000
30.000.000
35.000.000
40.000.000
Total Number of Unique Samples in AV-Test.org's Malware Collection
Implications
• Summary of the above– More and more malware is released– More and more signatures are provided– More and more updates are released– … and the updates are getting bigger– Programs are getting bigger– (Relative) Detection rates remain the same
Implications
0
2.500.000
5.000.000
7.500.000
10.000.000
12.500.000
15.000.000
17.500.000
20.000.000
22.500.000
25.000.000
27.500.000
30.000.000
32.500.000
35.000.000
All Samples vs. Detected Samples (95% Detection Rate)
Detected Samples Samples
Implications
0
200.000
400.000
600.000
800.000
1.000.000
1.200.000
1.400.000
1.600.000
1.800.000
Undetected Samples
Implications
64,3
35,1
14,2
11,0
10,6
5,0
3,0
2,8
2,3
1,0
0,7
0 5 10 15 20 25 30 35 40 45 50 55 60 65
New Samples per Month
Number of Signatures
Size of Updates
Size of Signature File
Number of Samples
Number of Updates
Size on Disk
Size per Update
Size of Other Components
Zoo Detection
Price
Growth Factor 2005-2010
Implications
0
20.000.000
40.000.000
60.000.000
80.000.000
100.000.000
120.000.000
140.000.000
160.000.000
180.000.000
200.000.000
2004
-09
2004
-11
2005
-01
2005
-03
2005
-05
2005
-07
2005
-09
2005
-11
2006
-01
2006
-03
2006
-05
2006
-07
2006
-09
2006
-11
2007
-01
2007
-03
2007
-05
2007
-07
2007
-09
2007
-11
2008
-01
2008
-03
2008
-05
2008
-07
2008
-09
2008
-11
2009
-01
2009
-03
2009
-05
2009
-07
2009
-09
2009
-11
2010
-01
2010
-03
2010
-05
2010
-07
2010
-09
2010
-11
2011
-01
2011
-03
2011
-05
2011
-07
2011
-09
2011
-11
Total Number of Unique Samples
Forecast
Implications
0,00
1.000.000,00
2.000.000,00
3.000.000,00
4.000.000,00
5.000.000,00
6.000.000,00
7.000.000,00
8.000.000,00
9.000.000,00
10.000.000,00
2004
-09
2004
-11
2005
-01
2005
-03
2005
-05
2005
-07
2005
-09
2005
-11
2006
-01
2006
-03
2006
-05
2006
-07
2006
-09
2006
-11
2007
-01
2007
-03
2007
-05
2007
-07
2007
-09
2007
-11
2008
-01
2008
-03
2008
-05
2008
-07
2008
-09
2008
-11
2009
-01
2009
-03
2009
-05
2009
-07
2009
-09
2009
-11
2010
-01
2010
-03
2010
-05
2010
-07
2010
-09
2010
-11
2011
-01
2011
-03
2011
-05
2011
-07
2011
-09
2011
-11
Undetected Samples
Forecast
Implications
Size of signatur
e file69%
Size of other components
31%
2015
Size of signature file
92%
Size of other components
8%
2020
0
200
400
600
800
1.000
1.200
1.400
1.600
2005 2010 2015
In M
B
Size on Disk
Size of signature file Size of other components
Implications
010.00020.00030.00040.00050.00060.00070.00080.00090.000
100.000
2005 2010 2015
in G
B
Total Size of Updates per Year
0
200.000
400.000
600.000
800.000
1.000.000
1.200.000
2005 2010 2015
Number of Updates per Year
Implications
• Fortunately the Anti-Malware Industry ismuch more innovative then just makingeverything bigger on the client …
• … instead they make everything bigger andmove it from the client to the cloud
• And from time to time they develop new approaches to detect malware
Implications
• What else can be concluded from thenumbers above?
• Your customers get a lot more value on 2010 than they did in 2005!
• How is that?
Implications2005 2010
Signatures / € 2.322 114.590Program Size / € 1,95 MB 8,29 MBUpdates / € (per year) 16 68Size of Signaturefile / € 0,17 MB 2,63 MBDetections / € 62.011 920.325Features Detect Malware Detect Malware
… and numerousinvaluable additional features
Conclusions• There are a lot of numbers and statistics to measure,
to come up with and to draw conclusions from• Not all of them are useful
– No product is like the average– Sometimes there is no causal relationship
• Those that are useful may only be useful in a limited time frame– Detection rates change, depending on sample set, signature
database, …• Some developments and growth rates can be
estimated, many can’t– It is nothing more than an estimation
top related