Antivirus Filtering

📘 Antivirus Filtering — Exam Notes (Network Security)

---

🔐 1. Definition

Antivirus Filtering is the process of detecting, blocking, and removing malicious software (malware) from systems and network traffic using antivirus tools.

👉 Simple idea: It acts like a security filter that scans files, emails, and data to stop viruses and harmful programs.

---

🎯 2. Objectives of Antivirus Filtering

• Detect and remove malware
• Prevent system infections
• Protect data and applications
• Ensure safe network usage
• Maintain system performance and integrity

---

🦠 3. Types of Malware Detected

🔹 Virus

• Attaches to files and spreads when executed

🔹 Worm

• Spreads automatically across networks

🔹 Trojan Horse

• Appears legitimate but is malicious

🔹 Ransomware

• Locks files and demands payment

🔹 Spyware

• Collects user information secretly

---

🔍 4. Antivirus Detection Techniques

🔸 1. Signature-Based Detection

• Matches files with known malware signatures

✔ Fast and accurate ❌ Cannot detect new (unknown) malware

---

🔸 2. Heuristic-Based Detection

• Analyzes behavior to detect suspicious activity

✔ Can detect new threats ❌ May produce false positives

---

🔸 3. Behavior-Based Detection

• Monitors real-time actions of programs

✔ Effective against advanced attacks

---

🔸 4. Sandboxing

• Runs suspicious files in a safe environment

✔ Prevents damage to real system

---

🧱 5. Types of Antivirus Filtering

🔹 File-Based Filtering

• Scans files stored on system

---

🔹 Email Filtering

• Scans email attachments and links

---

🔹 Web Filtering

• Blocks malicious websites

---

🔹 Network-Level Filtering

• Scans data traffic across the network

---

🔄 6. How Antivirus Filtering Works

1. File or data enters system

2. Antivirus scans using detection methods

3. Compare with database or behavior rules

4. Action taken:

   • ✔ Allow
   • ❌ Quarantine
   • ❌ Delete

---

🛡️ 7. Key Features of Antivirus Systems

• Real-time protection
• Automatic updates
• Scheduled scanning
• Quarantine of infected files
• Malware removal

---

⚠️ 8. Limitations of Antivirus

• Cannot detect all new threats
• Requires regular updates
• May slow system performance
• False positives possible

---

🧠 9. Best Practices

• Keep antivirus updated
• Run regular scans
• Avoid downloading unknown files
• Use with firewall and IDS/IPS
• Enable real-time protection

---

📊 10. Important Concept

🔸 Detection Rule

If File Signature = Known Malware → Block/Delete

---

🖼️ 11. Diagram Descriptions

📌 Antivirus Filtering Process

• File → Scan → Detection → Action (Allow/Block)

---

📌 Sandboxing

• Suspicious file → Isolated environment → Analysis

---

📌 Email Filtering

• Incoming email → Scan attachments → Safe/Blocked

---

🧾 12. Real-Life Examples

• 💻 Antivirus scanning downloaded files
• 📧 Email systems blocking infected attachments
• 🌐 Browsers warning about unsafe websites
• 🏢 Companies using antivirus for network protection

---

📝 Likely Exam Questions

1. Define antivirus filtering.
2. Explain different types of malware.
3. Describe antivirus detection techniques.
4. What is signature-based detection?
5. Explain heuristic and behavior-based detection.
6. What is sandboxing?
7. Describe types of antivirus filtering.
8. What are advantages and limitations of antivirus?
9. How does antivirus software work?
10. Write short notes on:

• Ransomware
• Spyware
• Email filtering

---

📌 Quick Summary / Conclusion

• Antivirus filtering protects systems from malware attacks.
• It uses techniques like signature, heuristic, and behavior analysis.
• Types include file, email, web, and network filtering.
• Regular updates and proper usage are essential.

👉 In short: Antivirus filtering is a key defense mechanism that detects and removes malicious software, ensuring safe and secure network operations.

---