[frasaian]

Originariamente inviato da Venturer

Stai parlando del motore di scansione antivirus! Il motore euristico di Bitdefender è "comportamentale" ma non è basato totalmente su un HIPS; io mi riferivo cmq alla suite in generale. Ad esempio il firewall del BitDefender non usa un HIPS per questo ottiene un ranking molto basso. Se lo implementassero anche nel firewall sarebbe molto più sicuro (i concorrenti hanno già firewall HIPS).

Ti riporto cosa mi ha scritto Cris del supporto BitDefender:

A HIPS is something different from the firewall. A firewall is a firewall, a HIPS is a HIPS.
The firewall's job is strictly to monitor and filter internet traffic. Either per/application, per/protocol, per/source or destination, block inbound attacks, etc...

A HIPS is a local application, which has nothing to do with internet traffic, at least not directly. It can help in many situations, yes, like in the case when a malicious application tries to take over your browser so it can send and receive data from the internet (and since the browser is allowed in the Firewall, the malicious application won't have problems connecting). And a HIPS' role is to detect and block such behavior.
But the same behavior applies when a process tries to hijack another process, like a system process. A HIPS will also block this attempt, even though it doesn't have anything to do with internet and traffic.

BitDefender 2010 will have a sort of HIPS module. Not a full HIPS, but a Behavioral Scanner. In fact, BitDefender 2009 already has this module (but I believe in v2010, it will be more advanced).

Grazie della spiegazione!