How ESET antivirus software works?

Unlike standard antivirus products, ESET uses multilayer technologies. This makes it possible to detect and block threats in time, before real problems can arise.

DNA Detections

ESET antivirus software possesses a DNA detection system. Features range from specific hashes to ESET DNA Detections. These are complex definitions of malicious behavior and malware characteristics. Timely recognition ensures that malicious files and code can be destroyed before they can actually cause damage.

Hackers can easily modify malicious code, but the behavior of the software cannot be easily changed. ESET DNA Detections takes advantage of this principle.

Unified Extensible Firmware Interface (UEFI) Scanner

ESET adds a special layer to its solution called the Unified Extensible Firmware Interface (UEFI). The ESET UEFI Scanner monitors and maintains the security of the pre-boot environment that conforms to UEFI specification. The layer is designed to monitor the integrity of the firmware. As soon as changes are detected, they are reported to the user.

Machine Learning

ESET Augur is ESET's internal machine learning engine. It uses deep learning and short and long term memory (neural networks). In addition, there are six manually selected algorithm classifiers that allow it to generate highly reliable output. This helps to properly label an incoming sample as malicious, possibly malicious or not malicious.

ESET Antivirus software includes:

• Cloud Malware Protection System: unknown, potentially malicious software and other potential threats are monitored and added to the ESET cloud via the ESET LiveGrid Feedback System.
• Ransomware Shield: ESET Ransomware Shield is an additional layer that protects users from ransomware. This technology monitors and evaluates all running applications based on their behavior and reputation. It is designed to detect and block processes that resemble behavior of ransomware.
• Reputation & cache: When inspecting a file or URL, ESET antivirus checks the local cache for known malicious or allowed benign objects before a scan. This improves scanning performance.
• Gedragsdetectie en Blokkering – HIPS: monitors system activity and uses a predefined set of rules to recognize suspicious system behavior and trigger the self-defense mechanism if necessary.
• In-product Sandbox: technology that allows different components of computer hardware and software to run as a sample in an isolated virtualized environment.
• Advanced Memory Scanner: monitors the behavior of processes as soon as they show themselves in memory, to detect malware.
• Exploit Blocker: monitors common vulnerabilities in third-party applications (browsers, documents, email clients, Flash, Java and more). Instead of focusing on specific CVE identifiers.
• Network Attack Protection: is an extension to current firewall technology and improves the detection of known vulnerabilities at the network level. This provides an important layer of protection against the spread of malware within the network, network-related attacks, and exploitation of vulnerabilities for which a patch has not yet been released or released.
• ESET Botnet Protection: detects malicious communications used in botnets while identifying the process that causes it. Any malicious detection is blocked and reported to the user.