Jump to content

0xDEADBEEF

Most Valued Members
  • Content Count

    302
  • Joined

  • Last visited

  • Days Won

    3

0xDEADBEEF last won the day on June 5 2018

0xDEADBEEF had the most liked content!

2 Followers

Profile Information

  • Location
    USA

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

  1. SHA256: 1f15a3e297b9017c40276ad1c32d606c8beebbf432227b47360f3674bfb60127 already 30/70 detected in VT but still pass through all defense layers by ESET
  2. My personal view on these discussions is that the two products are not comparable with such drastic difference in false positive rate. It is much easier to achieve a "100%" rate in such test if you are willing to sacrifice the detection accuracy (i.e. mark benign files as malicious) by tuning your detection knob of the model to be a bit more aggressive. ESET can definitely do this, but ESET chose not to do such thing for a good reason (there are more reasons but those are beyond the scope of this post) : in reality users are more likely to be bugged by FPs instead of real threats if the detection threshold is too aggressive. When users are getting used to dealing with FPs of a security product, they are more likely to blame and turn off the AV to use unknown riskwares next time. This generally makes a security product useless. Therefore, controlling the FP is of great great significance. And honestly speaking, even some products have very nice looking FP scores in this test, in reality they do noticeably worse than ESET. For many products which perform flawlessly in AVC's FP test (like those 0 FP ones), I can easily find FP PE files distributed by large IT companies with valid digital signature every month or two (yes, they still make such mistakes even with the help of very mature reputation cloud), but it is really hard to find such FP cases in ESET products. FP is much harder to be measured by a standardized test like AVC because there are grey zones. Plus the realworld situation of white files are far more complex than the training set in the lab. Only extensive real-life use experiences of these products will tell.
×