The name perfectly captures the nature of the tests: the samples used in the study come from real attacks on honeypots, i.e. traps that pretend to be systems or protocols and intercept malware.
If you are a manufacturer, distributor, or developer and you would like to join our tests, simply contact us. In response, we’ll ask you to provide guidance on the proper operation of your product. We will also arrange other details that are needed to develop an automated malware detection procedure.
Yes. If you think your solution is not fully developed or you are afraid of getting low evaluation, you can join the test for a trial period. The protection results will not be made available to the public. In addition, we will provide you with the necessary details to help improve the effectiveness of your product’s protection.
It is not true that charging for the preparation and publication of tests is synonymous with manipulating results. Once caught up in fraud, the organization will never again be able to rebuild its position and credibility. The very small fee collected is treated by both parties as remuneration for work and improved user safety. Without financial help, maintaining the infrastructure, continually improving the procedures and necessary tools needed to conduct the tests would not be possible. In return, we offer access to detailed information and samples used in the test to each creator. The studies “Advanced In-The-Wild Malware Test” are conducted under the AVLab brand that has been known at the market for 6 years – marketing benefits are the added value.
Yes, but we do not have a test schedule developed. In large comparative tests, we focus on checking the protection against sophisticated cyberattacks. Preparing such study, co-operation with manufacturers to improve security and producing a final report takes far more time than automatic verification of the protection on the basis of malicious software samples.
Of course. We can prepare detailed reviews that will be published on AVLab and CheckLab. Interested manufacturers of software and hardware are encouraged to contact us.
The only source of the virus samples are honeypots located on all continents of the world. We collect malicious software, among others for Windows. Before the samples are tested, they are checked based on more than 100 models. These rules allow to determine if the virus is a real threat to the Windows 10 operating system. Malicious software that for various reasons is not suitable for testing is separated from the rest. Only the malicious files that have suspicious indicators will be added to the test virus database on the following day. In other words – malware that e.g., modifies system parameters, encrypts files, manipulates keys and registry values, runs malicious scripts, loads malicious DLLs into processes – is considered useful.
Yes. If you want to access the virus database, please contact us. This service is payable. The reliability of our tests is always at the top of the list, so the database that you have access to will be already checked by antivirus software.
The tests are performed in virtual machines. Virtualisation is increasingly being used in VDI (Virtual Desktop Infrastructure) work environments. We use scripts that further “harden” the system, which makes it more difficult for viruses to detect virtualization. We realize that some worms may detect their launch in a virtual system, so we only take into consideration those samples that have been thoroughly verified before. We do not include malicious software that is able to detect well-hidden virtualization. This is not an ideal solution, but we are doing everything we can to approach the tests professionally and reconcile these aspects at the same time.
On the basis of detailed logs. We have developed over 100 indicators that are likely to point out any malicious changes introduced to the system. The more such indicators are in the logs, the greater the chance that a particular sample is malicious. For more details on acquiring and analysing malware, see other documents.
Logs from the activity of each sample are recorded in the system event log. This solution helps us to export the necessary information to CSV files. Based on the collected data, the algorithms developed determine whether a particular sample is undoubtedly malicious or whether it has been stopped by a security product installed – we can with certainty determine whether the protection program has stopped malicious software using the signature or proactive protection components. Analysing logs is very time consuming, so we have developed the algorithms that implement this process. We also cooperate with manufacturers – if they draw our attention to a certain issue, we look at the problem and take the necessary steps to address it. We are open to any form of cooperation that will benefit Internet users and allow us to gain more and more competence in what we do.
Our motto is transparency. We wanted to show the reader as much information as possible. We decided to present the results in a more precise way than other professional testing organizations do. This means that the reader in “Advanced In-The-Wild-Malware Test” performed by CheckLab will find detailed information on the detection of each sample broken down into protective technologies that contributed to it.
We want to provide users with an online platform for sharing information about threats. Systematic improvement of already developed tools and methodology is a natural process.
AVLab.pl portal that deals with the security and testing of products for monitoring, managing and protecting workstations. We have been actively operating on the market since 2012. AVLab tests discussed on international portals are recognized and appreciated by manufacturers. Our recommendations speak for themselves. For more information, see the “About Us” section.
