Security and antivirus suites: what protections are really necessary and most useful?

Often confused with security suites, antivirus software is only part of it. Indeed, it is the main functionality on which software relied to develop their security software, before becoming the suites we know today.

It was in the 80s that the first antivirus was born. At that time, and until the 2000s, antiviruses were only designed for one purpose: to eliminate viruses. They work thanks to a database, a “threat directory” made up of “signatures” to be searched for in the files. These signatures are illustrated by sequences of characters which tend to identify the virus within the files. Except that this method quickly found its limits. Because like real viruses, they can mutate and change “signature”.

Over time, our world has seen the arrival of antiviruses with a heuristic analysis algorithm. This novelty allows them to detect threats more broadly by creating signatures by family. Thus, no need to store a signature for each virus, one is enough for all mutations and subcategories. Although more effective at detecting viruses, this method still generates a problem: a larger signature means that certain innocuous files are considered threats. This is called false positives. A large part of the work of the developers has therefore consisted of minimizing the rate of false positives, while detecting 100% of the malicious programs. By dint of optimization, publishers have succeeded in moving antivirus protection from reactive, or analysis that is done on demand or in a programmed manner, to proactive, or analysis in real time.

With the democratization of the Internet, the general public unwittingly discovers viruses, and by extension computer security and insecurity. But it is also the advent of viral database updates, or the famous automatic online “directory”.

The term security suite was only adopted in the 2000s by publishers. The latter aspire to make their antivirus a formidable weapon against malware.