The name of the dose: does malware naming still matter?

Pierre-Marc Bureau and David Harley ESET

Years ago, when alt.comp.virus was still useful, 'Name that virus' was a popular virtual party game, virus names were, if not standardized, at least easy to cross-reference with tools like Vgrep. In 2008, the numbers have escalated exponentially, analysis and detection has become increasingly generic, and naming, even for some WildList malware, has become nearly useless because of the difficulty of mapping samples to names.

The CME initiative, while attempting to achieve something many people wanted, seems to have foundered on the rocks of the reality. Yet we continue to provide 'top ten' threat lists that have virtually no commonality or consistency across different vendors and sites, so that our customers continue to ask whether we detect the media virus du jour, and the slashdotty community point to us and giggle at our incompetence in failing to provide information about what we detect.

Are all our solutions going generic? Are there ways to resolve this issue so that our customers can understand what's happening and regain some faith in the industry without being hung up on the question 'Do you detect virus X?' We think so, and will discuss some possible approaches in this paper.



twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.