File Analysis

Within the Avira Protection Cloud, we apply multiple techniques to uncover malicious code. One of these, Dynamic File Analysis, combines multiple sandbox approaches for behavioral profiling to cluster and reveal similarity in the behavior of malware and identify advanced threats. Powerful rules allow the identification of behavior patterns that are specific to malware families and strains, or reveal the exact malicious intent of  malware itself. 

Dynamic File Analysis uses an ensemble of techniques to develop intelligence, including probability prediction, feature extraction, and context generation.

Machine Learning

Our machine learning system massively scales and automates the detection and prevention of cyber threats. Advanced machine learning models help us identify new forms of malware, prevent zero-day attacks, detect targeted malware and deliver the highest detection rates in the cyber-security industry.

Avira applies machine learning both within the cloud and locally within the client to detect and classify advanced threats. 

Advanced Heuristics 

Within the Avira Protection Cloud lies the extended scanning engine, an extremely efficient way of identifying families of known malware. It uses proprietary definitions and heuristic algorithms as well as powerful content extraction and de-obfuscation techniques to identify malware. This powerful scanning engine is capable of analyzing files far more thoroughly than any endpoint scanning tool and quickly reaches a conclusion whether code is part of a known malware family.

The engine also utilizes highly advanced decomposition techniques that extract and reveal compressed and obfuscated data within the malicious file in real-time. 

Data Correlation

The Avira Protection Cloud uses contextual analysis to correlate and develop intelligence.  Correlation identifies novel families of malware, reveals hidden threat patterns, and delivers highly sophisticated behavioral profiling of malware.

Intelligence is created from the information developed by our analysis engines. The intelligence is maintained within our contextual databases and delivered to our partners through our APIs and machine-readable threat feeds. We also develop it into sophisticated heuristics, generics, and models for our anti-malware SDKs.