Tuesday, December 14, 2010

Final Project

Antivirus Combat: Kaspersky VS. Eset nod32
As the Personal Computer (PC) becomes more and more popular, the creation of computer viruses grows. Do you use antivirus software to fight against the virus? What antivirus software can protect your PC effectively and efficiently? Which antivirus software is the best of all? Now I would like to introduce you the most popular two antivirus software of all—Kaspersky and Eset nod32. We may compare and contrast the features like search engine, protection abilities, virus detection rate and so on. Well, just keep this in your mind that antivirus is just a tool to keep you away from threats, but not all of them! Good habits, which are necessary, can be your best weapon to fight against the threats.
First things first, what is computer virus?
“A computer virus is a computer program that can copy itself and infect a computer.” But “virus” cannot include other types of malware, which contains adware and spyware. A virus can spread itself through a network or the internet; however, malware cannot do it. Virus can infect files on a network file system or a file system to increase the chance to spread itself. Malware, which is more proper to describe the true virus, includes computer viruses, computer worms, Trojan horses, rootkits, spyware and other types of software.

Then you may ask what is antivirus?
“Antivirus or anti-virus software is used to prevent, detect, and remove computer viruses, worms, and Trojan horses.” It will also help you prevent and remove adware, spyware, and other forms of malware. Each type of virus has a unique signature code to classify it. Several years the search engines mainly detected known signature codes to discover virus. However, nowadays, the virus is growing faster and faster. Computer may probably get infected with new malware with unknown signature codes. Some new technologies will be introduced to fight new viruses, such as zero-day threats, heuristics. Some antivirus software can run the virus in a virtual circumstance to predict whether it is a virus or not.
Before we start the combat, we may need some knowledge about the two fighters.
First, let us have a look at Kaspersky. The “Kaspersky Lab” started in 1989. When Eugene Kaspersky, one of the founders, had come across the computer virus problem for the first time, then the first version of Kaspersky antivirus had been opened up. Kaspersky Lab is an international information security software supplier. It has been fighting against the computer virus for more than 14 years.
Then, let’s look at Eset nod32. nod32, which is an antivirus product, was invented and designed by Eset. Eset, which is an international security protection software company founded in Slovakia in 1992, is mainly committed to provide services for enterprises and individuals. nod32 provides the best protection to the users with the least impact on your computers.
After having a rough knowledge of the two competitors, let us wait and see the combat between the two fighters!
The most important core and also the most outstanding feature of the antivirus is the search engine.
Kaspersky has one of the most famous original search engines in the world. It has a strong unshelling ability to against the multi-shelled objects. No matter how many shells attached to the file, also will be unshelled by Kaspersky. Then comes the complete signatures, which maybe the most useful way to detect virus. Kaspersky has the most complete signatures so that even no virus can escape from Kaspersky. It usually spends a large sum of time to scan the whole computer. When we use Kaspersky, we may feel our computers run slower than before. This result from the Kaspersky’s powerful search engine is working to protect your computer.
Then, nod32 (short for Eset nod32) can have a show. Unlike Kaspersky, nod32 uses genetic signature heuristic engine, which means nod32 has a smarter and more efficient engine. Genetic signature means the same signature part lies in the same type but different kinds of virus. This can reduce the space occupation of disk but contain more. The strong heuristic search method is also the big difference between two. This kind of detection method is used to detect unknown virus. It let virus run in a virtual environment, but under safe condition. In this way, nod32 can detect more unknown virus. Most users even say they have already forgotten nod32 after they have installed it.
       Here is a clear scan process graph about nod32:

       According to this round, we may tell Kaspersky has a powerful but big-impact engine, while nod32 has a smart but faster engine.
After that we may discover the protection abilities of the two fighters. The protection abilities manly contain variety of methods to protect your computer from known or unknown threats.
Kaspersky has a very complete protection mode. It has powerful HIPS ability to against the unknown virus. HIPS is also known as Host-based Intrusion Prevention System. This technology is based on behavioral analysis to protect your computer. It contains AD (Application Defend), RD (Registry Defend) and FD (File Defend). This is so-called 3D protection. And Kaspersky has another “D”, which is ND (Network Defend). In this way, Kaspersky has the most powerful 4D protection to defend your computer. Other protection ways have firewall, anti-spam, anti-fishing and anti-advertisement.
What nod32 has to protect your computer? nod32 only has 2 protection methods. They are firewall and anti-spam. Everyone can tell Kaspersky has more powerful protection ability.
So nod32 loses this round, what a pity! After this round, Kaspersky has gained one mark first.
And at last, the most important round begins. People all care about the virus detection ability most. Due to the powerful search engine, Kaspersky has serious effects on your computer. One of the most serious impacts is that sometimes the computer will get stuck during the virus scanning. Unbelievable! How can we do our work on our computers under such unsteady condition? Although the big effects come to our computers, the virus detection rate is very high; it is close to 90%.
Here is a test list about the Kaspersky detection rate in September:
Date
Signature Detection
Heuristic detection
Sample Amounts
Detection Rate (%)
1
64
5
82
84.146%
2
73
1
86
86.047%
3
65
1
78
84.615%
4
74
2
106
71.698%
5
42
1
51
84.314%
6
42
2
52
84.615%
7
25
1
27
96.296%
8
26
0
30
86.667%
9
32
0
35
91.429%
10
13
0
20
65.000%
11
37
1
47
80.851%
12
21
1
24
91.667%
13
20
3
34
67.647%
14
20
0
24
83.333%
15
26
1
30
90.000%
16
11
1
20
60.000%
18
33
0
34
97.059%
19
20
1
22
95.455%
20
43
3
53
86.792%
Then, nod32 can come to show up. Due to the special scan methods, nod32 even has a very little effect on our computers. We can even tell no effects on our computers! But the scan speed is very fast, maybe the highest speed of all the antivirus software. The average virus detection rate will be even higher, it nearly reaches 100%.
Here is the test list about nod32 detection rate in September:
Date
Signature Detection
Heuristic detection
Sample Amounts
Heuristic detection rate
Total detection rate
1
31
34
82
41.46%
79.27%
2
39
38
86
44.19%
89.53%
3
41
26
78
33.33%
85.90%
4
48
42
106
39.62%
84.91%
5
31
14
51
27.45%
88.24%
6
35
11
52
21.15%
88.46%
7
20
7
27
25.93%
100%
8
18
9
30
30%
90%
9
21
9
35
25.74%
85.71%
10
9
5
20
25%
70%
11
25
18
47
38.30%
91.49%
12
17
6
24
25%
95.83%
13
5
18
34
52.94%
67.65%
14
11
12
24
50%
95.83%
15
6
19
30
63.33%
83.33%
16
5
6
20
30%
55%
18
10
24
34
66.67%
100%
19
10
11
22
50%
95.45%
20
13
33
53
62.26%
86.79%
From the illustration above, we can tell that nod32 most based on heuristic detection to detect virus. What a powerful technology! So Kaspersky has been knocked out in this round.
To sum up, the final score is 1-1. The combat is draw.
In today’s modern time, a lot of new virus will come up every day. There is no antivirus software that can keep you 100% safe. The speed of virus growth always goes one step ahead than antivirus software, so maybe one day your PC will get infected.
Then what can prevent your away from virus? Good habits! Yes, good habits can make sure your computer is safe from virus on the greatest scale. This may need some time to fall into the habit of operating the PC. But this may bring a lot of benefits more than get a piece of powerful antivirus software. Apart from antivirus, good habits can be more effective and efficient protect your computer away from virus.


References:
1. The virus scan test lists come from http://bbs.kafan.cn & http://bbs.vc52.cn/
2. Kaspersky test list from
Kaspersky2009/2010 [September test]
by sam.to
3. Eset nod32 test list from
ESET NOD32 3.0.684.[September informal test]
by lovenod32
4. Kaspersky test list from
Kaspersky2009/2010 [September test]
http://bbs.vc52.cn/thread-186577-1-1.html
by lxzzzzzzzzz
5. Eset nod32 test list from
ESET NOD32 3.0.684.[September informal test]
by 丁噹