Resurrecting anti-malware through collaboration

A number of reports indicate that malware infection rates continue to increase, additionally, the reports also indicate that malware is becoming increasingly advanced. The spread of malware has grown to such an extent that a number of security experts have declared that anti-virus is dead. We propose an architecture called Collab-AV that can be used to address the anti-malware product vulnerabilities. The Collab-AV architecture is based on the principle of collaboration between different sources of information and different existing anti-malware vendors thus following a "strength in numbers" philosophy. The Collab-AV architecture is essentially divided into three layers as follows: Collab-AV Remote Layer: Represents all the components of Collab-AV that exist outside of the users' environment i.e. external to the user's computer. This layer is responsible for providing Collab-AV with actionable threat intelligence by gathering and utilising information gathered from the following sources: malware hash registries, benign software hash registries, threat information sources and trusted Collab-AV Peers. Collab-AV Local Layer: Contains the most important sub-systems of Collab-AV that execute on the user's computer. The sub-systems are collectively responsible for ensuring that the user is protected from malware infections by utilising the information gathered from the Collab-AV Remote layer and information gathered from the user's computer. Collab-AV Evaluation Layer: The purpose of this layer is to evaluate Collab-AV by continuously testing it for new vulnerabilities. The objectives of this layer can be achieved by using the evaluation framework we defined in our previous work or by integrating evaluations by third parties such as AV-Comparatives. The outputs of the evaluations will be used to guide future improvements on Collab-AV. The Collab-AV architecture has been designed to work with existing anti-malware products as opposed to replacing them while ensuring increased detection rates, trust, scalability and privacy.