I have a question here as well, just to understand Trend Micro better. Although I could ask in the business part of the community too, but here the subject is already initiated.
I could also find the Smart Scan patent on Justia and read in depth :-)
So, the poor detection rate certainly has got something to do with the Smart Scan (using 2 seperate patterns). It looks like Smart Scan Agent Pattern needs to flag something suspicious and at that point the full definition will be retrieved from the server. Is that how it works?
Also, how do you decide which malware to drop? Because ransomware can wreak havoc even when it is very old. Infostealers may have dead C&Cs, but a lot of them possess an update function. Do you check these C&Cs using an automated system? Or do you just automatically clean up everything >6 months of age? I am very curious how the cleanup decision is taken (though I understand you may wish not to disclose).
Why some sort of hash-based detection is not still maintained on TM smart protection network?
Malicious files, even when old, should have reputation different than "safe". In that case, ATSE should be called on these files. Is PML not getting trained to detect these samples?
I understand that pattern needs to be minimalistic and requires maintenance, but why other layers don't cover these threats, such as behavioural analysis and policy enforcement?
