CloudAVN-Version Antivirus in the Network Cloud.PDF

CloudAV: N-Version Antivirus in the Network Cloud Jon Oberheide, Evan Cooke, Farnam Jahanian Electrical Engineering and Computer Science Department University of Michigan, Ann Arbor, MI 48109 {jonojono, emcooke, farnam }@ Abstract and tools presents a daunting challenge for network op- Antivirus software is one of the most widely used tools erators and IT administrators. Antivirus software is one for detecting and stopping malicious and unwanted files. of the most widely used tools for detecting and stopping However, the long term effectiveness of traditional host- malicious and unwanted software. However, the elevat- based antivirus is questionable. Antivirus software fails ing sophistication of modern malicious software means to detect many modern threats and its increasing com- that it is increasingly challenging for any single vendor to plexity has resulted in vulnerabilities that are being ex- develop signatures for every new threat. Indeed, a recent ploited by malware. This paper advocates a new model Microsoft survey found more than 45,000 new variants for malware detection on end hosts based on providing of backdoors, trojans, and bots during the second half of antivirus as an in-cloud network service. This model en- 2006 [17]. ables identification of malicious and unwanted software Two important trends call into question the long term by multiple, heterogeneous detection engines in paral- effectiveness of products from a single antivirus vendor. lel, a technique we term ‘N-version protection’. This First, there is a significant vulnerability window between approach provides several important benefits including when a threat first appears and when antivirus