The Economist reports that a paper published in Nature Physics by Eran Shir of Tel-Aviv University in Israel and his colleagues may offer a new approach.
 
The weakness of most antivirus software is that it is reactive, not proactive. A virus must be identified — and then a solution must be developed — before defensive systems can react. This can take a lot of time, during which countless new computers can be infected.

The approach of Dr. Shir is like fighting a virus with a virus, but in a unique way.

So-called “honey pots” are software designed to attract viruses by being especially susceptible to all kinds of infection. Antivirus firms place these strategically in networks.

What’s new here is the idea of linking these “honey pots” through a kind of secondary network. When they pick up a virus, the honey pot programs would work together to quickly identify the unique elements of a new virus.

Then they would take that unique ID and automatically encapsulate it into a new virus that would spread through the network. The new virus would infect all the other computers, but do so in a way that preempts infection by the original virus.

Statistically speaking, this system would become ever more effective as more computers use it. In a network of 50,000 computers, if four-tenths of 1% of them were honey pots, roughly 5% of computers in the network would become infected before they could be immunized. On the other hand, a network of 200,000 computers would drop the spread of infection to 1%. If it could be established across a network of 200 million computers, not even one 1/1,000 of 1% would be infected.

Obviously, the potential savings are great. However, sometimes a revolutionary breakthrough is less than it appears.

Transformational Technologies Portfolio holding Commtouch (CTCH: NASDAQ) already has a similar system in effect for its customers. Essentially, all of the customers link their computers in a special private network, much as is proposed. Commtouch places special sensors (the company won’t say, but they sound like honey pots) across the network at strategic locations.

When a new virus (worm, spyware, or other malware) is detected, the company’s software instantly sends its profile to all computers on the network, which then can identify and quarantine the invader.

Commtouch’s approach relies on a feature most viruses have in common. They replicate quickly, thereby creating a “pattern” across the network.

The new approach seems complementary to that of Commtouch. Its immunization approach via a secondary virus is the new wrinkle. (The trick, of course, will be teaching computers to distinguish the new “immunity” virus from dangerous ones. Logically, the honey pot computers would send a special signal to accompany the immunization.)

Commtouch’s approach has repeatedly been proven superior to the competition in detecting viruses quickly and avoiding false positives (flagging messages as viruses that aren’t).

If the Commtouch system has a weakness, it would be detection of viruses that replicate slowly, not displaying virus-like behavior. The new method will detect and immunize against these as well.

Commtouch is an Israeli company, and the new research comes from Israeli researchers. As Israel’s leading antivirus company, I expect that Commtouch will be seeking to license this technology, as I have put this question to my friend Gideon Mantel, CEO of Commtouch.

I’ll let you know what I find out. Meanwhile, as recently reported here, Commtouch’s approach continues to flourish with major new contracts in China and South Korea.

To your profitable future,

Jonathan Kolber
December 20, 2006

Investing in Computer Technology was originally featured in the Penny Sleuth.