What if your desktop security application could detect and remove a new threat that was only minutes old? That's the impetus behind McAfee's Artemis technology, announced yesterday.
Artemis, which McAfee plans to market within its 2009 consumer products as "Active Protection," is not focused on hourly updates, or even 15-minute updates, as rival Symantec has. It means instant detection, said Dave Marcus, director of security research and communications for McAfee Avert Labs.
McAfee's use of Artemis is similar to Trend Micro's use of cloud-based computing to analyse and produce new signature files within 15 minutes in that software on the desktop, then pass suspicious files to a larger, remote database.
McAfee's Marcus said that the difference was that McAfee planned to use a desktop communication channel already built into the product, so existing users wouldn't need to download new software.
The file database maintained at McAfee Avert is much larger than what was possible on the desktop. Marcus said it was responsive to minute-by-minute changes in the threat landscape. The new technology opened a doorway to the larger database.
When asked if Artemis was a listening agent, one that reported desktop activity back to McAfee, Marcus dismissed the idea. He said that whenever the McAfee software found something suspicious and not in its signature database, it would ping the larger database back at McAfee Avert Labs to get the signature needed. The files sent back and forth were minuscule, he added.
Marcus confirmed that McAfee would continue to send down daily signature files, but, in the heat of the moment, if a new malware sample was received by a McAfee-protected computer, it would have instant protection from the vast database back at the company headquarters.
