PDA

View Full Version : the update thing



xpsunny
2008-12-27, 13:29
Total: 1298391 fingerprints in 366315 rules for 4505 products.

Please explain the terminologies in brief.

PepiMK
2008-12-27, 17:33
Products are probably easy - they're listed next to those numbers and are groups of rules that along belong to one specific malware, or one variant of such a malware.

Rules are very similar to what you can find in the OpenSBI wiki (http://wiki.spybot.info/index.php/Main_Page): one line (or better: one entry in a database) that defines things to detect.

One rule does not equal one detected object though; some rules are capable of doing more. A RootClass (http://wiki.spybot.info/index.php/RootClass) for example does not only detect an entry in HKCR\, but also associated CLSIDs, Typelibs, Interfaces, BHOs and files, which means that in some cases, one such rule could lead to the detection of e.g. 6 items, in which case it would be counted as six fingerprints.

We don't spread that too far though. Imagine for example a rule like File (http://wiki.spybot.info/index.php/File). We have some where a single rule detects ten of thousands of mutations of a single file, sometimes even mutations of multiple variants. In those cases, that is still counted as a single fingerprint because while we may have that many variants, an infected machine probably has only one.

So, fingerprints were added as a measurement method that would count a bit more direct, taking the differing complexity of different rule types into account to get a better impression of the count of detected items. Still, its not a perfect "count" (which imho does not exist at all), since there might be overlaps, there's the issue described with files above, and many more.
And while we don't add empty rules just to make the database look bigger, I remember some time ago when the database of another well known product was "hacked" someone reported that it had quite a few blank instructions for example - a thing that makes comparisons even more impossible than they already are.

xpsunny
2008-12-29, 07:30
Oh PepiMk! Thanks!

I wish, in next birth, you would be my college professor. :)