NGAV (Next Generation Anti-Virus) is software that prevents malware infections and attacks from malicious programs.
Antivirus (AV) has been around for over 30 years, but next-generation antivirus (NGAV) can detect unknown malware that traditional antivirus can’t.
How conventional antivirus (AV) works and the birth of next-generation antivirus (NGAV)
Antivirus has a long history, and each vendor released antivirus in the late 1980s.
Conventional antivirus (AV: Antivirus) employs a pattern-matching method.
The pattern-matching method literally analyzes malware pattern information and accumulates the confirmed data (signature code) in the definition database. Files suspected of having the same type of data as the accumulated signature code are detected as “malicious files” and the antivirus automatically quarantines or deletes them. As a result, conventional antiviruses that use pattern matching can only detect malware that has been detected in the past and have the disadvantage of being ineffective against unknown malware.
Especially in recent years, cyberattacks have become more sophisticated and complex, and the number of malware that incorporates techniques to avoid detection by conventional antiviruses is also increasing. Therefore, instead of detecting known malicious code, next-generation antivirus ( NGAV) was born.
Key Features of Next-Generation Antivirus (NGAV)
The main functions of next-generation antivirus (NGAV) are “behavioral detection,” “AI, machine learning,” and “sandbox.” Let’s take a look at each feature.
behavior detection
Behavior detection does not judge a file as malicious by looking at the structure or code of the file but judges it to be illegal by checking the file’s behavior, such as illegal behavior.
The pattern matching method can detect programs defined in the definition database, but cannot detect “gray” programs that are doubtful whether they are completely black.
Behavior detection makes decisions by looking at the behavior of the program itself, not the contents of the program, so it is possible to detect even suspicious “gray” programs.
AI, machine learning
Next-generation antivirus (NGAV) constantly monitors processes and collects information about possible attacks. Then, based on the analysis results of the collected information, malware that has never been confirmed before is detected. With the pattern matching method, which analyzes detected malware and compares it with a definition database, it is difficult to detect malware that evolves day by day in real-time. It is possible to detect unknown malware with high probability.
sandbox
For suspicious programs that cannot be determined to be malicious files, it is necessary to actually run the program and check its behavior. Prepare a virtual environment called a sandbox, run a suspicious program in a completely closed environment, and check its behavior.
In behavior detection and machine learning, it is a file that is predicted to be malicious and has not actually been confirmed. Therefore, even legitimate programs may be detected by mistake. By preparing an environment in which programs can be executed in a sandbox, detection accuracy can be improved.
Difference between machine learning type and deep learning type
The artificial intelligence (AI) used in next-generation antivirus (NGAV) has the following two learning types.
Machine learning type (machine learning)
In the machine learning type, the features are defined by hand, and artificial intelligence (AI) learns and analyzes them. Although there are advantages such as efficiency improvement through learning and analysis, there is also a disadvantage in that accuracy decreases when trying to learn more than 100 million rules. In recent years, it is said that more than 1 million pieces of malware are generated per day, and there is a limit to the detection of unknown malware with machine learning.
Deep learning type (deep learning)
In the deep learning type, artificial intelligence (AI) analyzes and learns from malware information at high speed and extracts malware features. Since artificial intelligence (AI) extracts features and learns by itself, it is possible to detect even unknown malware that is generated every day.
From these facts, it can be seen that deep learning type is superior among artificial intelligence (AI) adopted in next-generation antivirus (NGAV).
Next-Generation Antivirus (NGAV) and EDR
A product that is often confused with next-generation antivirus (NGAV) is EDR (Endpoint Detection and Response). EDR is a product based on the concept of follow-up measures that constantly monitors endpoints, notifies them when anomalies or suspicious behavior occurs and supports recovery. It is not intended to prevent the intrusion of threats, but rather to recover quickly if infected. On the contrary, next-generation antivirus (NGAV) is a proactive measure to prevent threats from intruding and has a different role. Therefore, by combining NGAV and EDR, security measures can be strengthened.
