The HIVE is alive

BitDefender has announced that phase one in the implementation of the Heuristics In Virtual Environments (HIVE) program has gone into full use in "real-world" systems. BitDefender customers are now protected by an entirely new layer of detection technology.

"What HIVE really does, in layman terms, is that it creates a virtual computer-inside-a-computer, where pieces of software that look suspicious are run, to see if they try to do any of the things that viruses and worms usually do," says local BitDefender distributor Grayford Holton.

"We are very worried that the number and variety of new viruses and worms will continue to increase, so we are constantly on the lookout for new technologies that will move us away from the reactive paradigm of signature-based detection," he explains.

The HIVE technology has been two years in the making, and will only be phased in completely by the end of the year. The HIVE technology is based on behaviour analysis in a virtual environment and has evolved from a previous concept, which was awarded an IST prize in 2003. The original MIDAS concept also referred to malware detection through behaviour analysis, but with a focus on intrusion detection.

"This is new ground for us, and we`re treading carefully, but the first results give us much reason for hope. The detection rates we`ve seen in tests are quite good, and further refinements should bring us even closer to our stated goal of 60% detection with HIVE. However, the reaction time gain is even more important than the detection rate. With HIVE in place, customers will be protected against some new viruses before virus samples even reach our lab," concludes Holton.