File Detection Test February 2010
of Malicious Software including false alarm and on-demand scanning speed test
|Test Period||February 2010|
|Number of Testcases||1224732|
|Online with cloud connectivity|
|False Alarm Test included|
The File Detection Test is one of the most deterministic factors to evaluate the effectiveness of an anti-virus engine. These test reports are released twice a year including a false alarm test. For further details please refer to the methodology documents as well as the information provided on our website. In this test, the following 20 up-to-date Security Products were tested using 1224732 prevalent malware samples.
- Kingsoft Antivirus 2010Build: 2010.2.10.1
- PC Tools Spyware Doctor with AV 7.0Build: 220.127.116.114
Each test system is running on Microsoft Windows XP SP3 including a respective security product, which was last updated on the 3rd of February 2010. The malware sets were frozen on the 10th February 2010. All products had Internet-access during the test and were tested using default settings. To ensure that all file recognition capabilities are used, we enabled scan of all files, scan of archives and scan for PUA in all products.
On each test system the malware set is scanned. The detections made by the security product are noted and analysed. Although no samples were executed during this test, we considered cases where malware would be recognized on-access, but not on-demand. The test is thus called File Detection Test (as opposed to the earlier On-Demand Tests), as on-access scanning is taken into consideration.
You will notice that this time the test-set with 1224732 samples is smaller than previous times. This is because we are now trying to include in the test-set mainly prevalent real-world malware being still around (within last eight months). To build the test-set we consulted (but as it was a first try, we did not exclusively rely on) metadata and telemetry data collected and shared within AV industry, as well as querying various clouds afterwards and requesting data of the most-common user-submitted malware. Malware we see on user PCâ€™s are automatically considered as important. Nevertheless, as with every first attempt, we noticed that not all sources are yet able to provide reliable prevalence data, so we had to clean up some sets afterwards. This will improve in future, as the industry is currently working on optimizing their data sharing processes.
The Awards are not only based on detection rates – also False Positives found in our set of clean files are considered. A product that is successful at detecting a high percentage of malware but suffers from false alarms may not be necessarily better than a product which detects less malware but which generates less FP’s.
The awards were given according to the table below (may change next time):
(given by the testers after consulting statistical methods)
|Few (0-15 FPs)|
|Many (over 15 FPs)|
The test-set used contained 1224732 recent/prevalent samples from the last few weeks/months. We estimate the remaining error margin on the final percentages to be below 0.2%.
Total detection rates (clustered in groups)
Please consider also the false alarm rates when looking at the file detection rates below.
Additional results: The McAfee detection rate with “very high” in-the-cloud sensitivity would have scored 99.0% and have “very many” false alarms.
Baseline minimum detection rates of some products when there is no Internet connection available (i.e. without their in-the-cloud technology): McAfee: 94.9% (19 FPs) , Panda: 73.3% (32 FPs), Trend Micro: 68.5% (22 FPs)
Graph of missed samples (lower is better)
Percentages refer to the used test-set only. Even if it is just a subset of malware, due its size, it is important to look at the number of missed malware. For example, 0.3% means almost 3700 missed malware samples from the used test-set.
The results of our on-demand tests are usually applicable also for the on-access scanner (if configured the same way), but not for on-execution protection technologies (like HIPS, behaviour blockers, etc.).
A good detection rate is still one of the most important, deterministic and reliable features of an Anti-Virus product. Additionally, most products provide at least some kind of HIPS, behaviour-based or other functionalities to block (or at least warn about the possibility of) malicious actions e.g. during the execution of malware, when all other on-access and on-demand detection/protection mechanism failed.
Please do not miss the second part of the report (it will be published in a few months) containing the retrospective test, which evaluates how well products are at detecting new/unknown malware.
Even if we deliver various tests and show different aspects of Anti-Virus software, users are advised to evaluate the software by themselves and build their own opinion about them. Test data or reviews just provide guidance to some aspects that users cannot evaluate by themselves. We suggest and encourage readers to research also other independent test results provided by various well-known and established independent testing organizations, in order to get a better overview about the detection and protection capabilities of the various products over different test scenarios and various test-sets.
Scanning Speed Test
Anti-Virus products have different scanning speeds due to various reasons. It has to be taken in account how reliable the detection rate of an Anti-Virus is; if the Anti-Virus product uses code emulation, if it is able to detect difficult polymorphic viruses, if it does a deep heuristic scan analysis and active rootkit scan, how deep and thorough the unpacking and unarchiving support is, additional security scans, if it really scans all file types (or uses e.g. white lists in the cloud), etc.
Most products have technologies to decrease scan times on subsequent scans by skipping previously scanned files. As we want to know the scan speed (when files are really scanned for malware) and not the skipping files speed, those technologies are not taken into account here. In our opinion some products should inform the users more clearly about the performance-optimized scans and then let the users decide if they prefer a short performance-optimized scan (which does not re-check all files, with the potential risk of overlooking infected files!) or a full-security scan.
The following graph shows the throughput rate in MB/sec (higher is faster) of the various Anti-Virus products when scanning (on-demand) with highest settings our whole set of clean files (used for the false alarm testing). The scanning throughput rate will vary based on the set of clean files, the settings and the hardware used.
The average scanning throughput rate (scanning speed) is calculated by the size of the clean-set in MB’s divided by the time needed to finish the scan in seconds. The scanning throughput rate of this test cannot be compared with future tests or with other tests, as it varies from the set of files, hardware used etc. The scanning speed tests were done under Windows XP SP3, on identical Intel Core 2 Duo E8300/2.83GHz, 2GB RAM and SATA II disks.
False Positive (False Alarm) Test Result
In order to better evaluate the quality of the detection capabilities of anti-virus products, we provide also a false alarm test. False alarms can sometimes cause as much troubles as a real infection. Please consider the false alarm rate when looking at the detection rates, as a product which is prone to cause false alarms achieves higher scores easier. All discovered false alarms were reported and sent to the respective Anti-Virus vendors and have now been already fixed.
|1.||eScan||1||very few FPs|
|3.||Bitdefender, ESET, Microsoft||3|
|5.||G DATA, Kaspersky||5|
|9.||Avast, Avira, Symantec||11|
|10.||Trend Micro||38||many FPs|
|15.||K7||193||very many FPs|
Details about the discovered false alarms (including their assumed prevalence) can be seen in a separate report available at: http://www.av-comparatives.org/wp-content/uploads/2012/04/avc_fps_201002_en.pdf
A product that is successful at detecting a high percentage of malicious files but suffers from false alarms may not be necessarily better than a product which detects less malicious files but which generates fewer false alarms.
The following chart shows the combined file detection rates and false alarms.
Award levels reached in this File Detection Test
AV-Comparatives provides a 3-level-ranking-system (STANDARD, ADVANCED and ADVANCED+). As this report contains also the raw detection rates and not only the awards, users that e.g. do not care about false alarms can rely on that score alone if they want to.
* these products got lower awards due to false alarms
K7, Panda, PC Tools and Trend Micro are new participants of the 2010 test-series.
Almost all products run nowadays by default with highest protection settings (at least either at the entry points, during whole computer on-demand scans or scheduled scans) or switch automatically to highest settings in case of a detected infection. Due that, in order to get comparable results, we tested all products with highest settings, if not explicitly advised otherwise by the vendors (as we will use same settings over all tests, the reason is usually that their highest settings either cause too many false alarms, have a too high impact on system performance, or the settings are planned to be changed/removed by the vendor in near future). To avoid some frequent questions, below are some notes about the used settings (scan of all files etc. is always enabled) of some products:
- AVIRA, Kaspersky, Symantec, TrustPort: asked to get tested with heuristic set to high/advanced. Due to that, we recommend users to consider also setting the heuristics to high/advanced.
- F-Secure, Sophos: asked to get tested and awarded based on their default settings (i.e. without using their advanced heuristics / suspicious detections setting).
- AVG, AVIRA: asked to do not enable/consider the informational warnings of packers as detections. Due that, we did not count them as detections (neither on the malware set, nor on the clean set).
AV-Comparatives prefers to test with default settings. As most products run with highest settings by default (or switch to highest automatically when malware is found, making it impossible to test against various malware with “default” settings), in order to get comparable results we set also the few remaining products to highest settings (or leave them to lower settings) in accordance with the respective vendors. We hope that all vendors will find the appropriate balance of detection/false alarms/system impact and will provide highest security already by default and remove paranoid settings inside the user interface which are too high to be ever of any benefit for normal users.
Copyright and Disclaimer
This publication is Copyright © 2010 by AV-Comparatives ®. Any use of the results, etc. in whole or in part, is ONLY permitted after the explicit written agreement of the management board of AV-Comparatives prior to any publication. AV-Comparatives and its testers cannot be held liable for any damage or loss, which might occur as result of, or in connection with, the use of the information provided in this paper. We take every possible care to ensure the correctness of the basic data, but a liability for the correctness of the test results cannot be taken by any representative of AV-Comparatives. We do not give any guarantee of the correctness, completeness, or suitability for a specific purpose of any of the information/content provided at any given time. No one else involved in creating, producing or delivering test results shall be liable for any indirect, special or consequential damage, or loss of profits, arising out of, or related to, the use or inability to use, the services provided by the website, test documents or any related data.
For more information about AV-Comparatives and the testing methodologies, please visit our website.