116 K
aspersky Internet Security 6.0
Proactive Defense tracks and blocks all dangerous operations by using the set of
rules together with a list of excluded applications. Proactive Defense also tracks
all macros executed in Microsoft Office applications.
In operation, Proactive Defense uses a set of rules included with the program, as
well as rules created by the user while using the program. A
rule
is a set of
criteria that determine a set of suspicious behaviors and Kaspersky Internet
Security's reaction to them.
Individual rules are provided for application activity and monitoring changes to
the system registry, macros, and programs run on the computer. You can edit
the rules at your own discretion by adding, deleting, or editing them. Rules can
block actions or grant permissions.
Let’s examine the Proactive Defense algorithms:
1. Immediately after the computer is started, Proactive Defense analyzes
the following factors, using the set of rules and exclusions:
•
Actions of each application running on the computer
. Proactive
Defense records a history of actions taken in order and
compares them with sequences characteristic of dangerous
activity (a database of dangerous activity types comes with the
program and is updated with the threat signatures).
•
Actions of each VBA macro run
are analyzed for signs of
malicious activity.
•
Integrity of the program modules
of the programs installed on
your computer, which detects the replacement of program
modules by versions with malicious code injected into them.
•
Each attempt to edit the system registry
by deleting or adding
system registry keys, entering strange values for keys in an
inadmissible format that prevents them from being viewed or
edited, etc.).
2. The analysis is conducted using allow and block rules from Proactive
Defense.
3. After the analysis, the following courses of action are available:
•
If the activity satisfies the conditions of the Proactive Defense
allow rule or does not match any of the block rules, it is not
blocked.
•
If the activity is ruled as dangerous on the basis of the relevant
criteria, the next steps taken by the component match the
instructions specified in the rule: usually the activity is blocked.
A message will be displayed on the screen specifying the
dangerous program, its activity type, and a history of actions
