- Signature detection. This approach gives you the ability to spot malicious code, among other things.
- Behavior monitoring. By adopting this technique, you can do things like spot malicious activity in a computer or determine if a suspicious file will respond to virtual bait
- Blacklisting. This is a mechanism for blocking access to sites and files that are included on a list of undesirable entities.
- Whitelisting. With this approach, essentially the opposite blacklisting, users are only allowed access to sites and files on a list of entities known to be harmless; access is denied to sites and files that aren't on the list.
Each of the four has its supporters and detractors, and all the anti-malware software vendors queried for this article said they use some form of all four weapons, in combination.
Other defenses include firewalls, which can prevent intrusions and -- with Windows at least -- are part of the operating system, and periodic vendor patches to address vulnerabilities.
Frequency of cyberattacks
The frequency of different types of attacks experienced during a four-week period in 60 companies benchmarked.
Viruses, worms, trojans: 100 percent
Malware: 97 percent
Botnets: 73 percent
Web-based attacks: 63 percent
Denial of service: 50 percent
Malicious code: 48 percent
Malicious insiders: 42 percent
Phishing/social engineering: 42 percent
Stolen devices: 33 percent
Source: Ponemon Institute/HP Enterprise Security "2013 Cost of Cyber Crime" study.
A question sometimes raised is whether there are more advanced weapons that we haven't yet learned about. "I've heard that [the anti-malware vendors] have better defenses up their sleeve that they choose not to release since they are not necessary yet, and they don't want to tip their hand," says Zeltser.
The vendors deny this. "Our secret weapons are in force every day -- it's a daily battle," says Tony Anscombe, an executive at anti-malware software vendor AVG Technologies. Indeed, if vendors had something that can stop all viruses "it would be foolish to wait to use it," says Kevin Haley, spokesman for anti-malware software vendor Symantec. "It would be a competitive advantage" to help sell more software, he points out.
Either way, the end result is that anti-malware software vendors can now respond to a new (or "zero-day") exploit within two hours, although complicated exploits may require subsequent follow-up, says Haley.
In parallel, there have been efforts to make software less vulnerable to infection. For instance, Tim Rains, director of Microsoft Trustworthy Computing, says that Microsoft has revamped the code libraries used by developers to remove errors and vulnerabilities.
As a result, he notes, stack corruption was the vulnerability exploited 43 percent of the time in 2006, but now it's used only 7 percent of the time. He also cites a study conducted in 2011 by analyst Dan Kaminsky and others indicating there were 126 exploitable vulnerabilities in Microsoft Office 2003, but only seven in Office 2010.
Years of security-related software patches downloadable by users have also had a measurable effect. Rains cites statistics derived from executions of Microsoft's online Malicious Software Removal Tool, which showed that systems with up-to-date protection were 5.5 times less likely to be infected.
As of December 2012, the rate was 12.2 infections per 1,000 machines for unprotected systems vs. 2 per 1,000 for protected systems. The global average was 6 infections per 1,000.