IT:AD:Malware Detection
Summary
At this point in time (Q3/2017) consider using https://scanii.com/ if no organisation provided publicly available authorised confidential (ie https) API endpoint is available.
Notes
- SaaS based commercial API.
- Recommendation: Recommended.
- Commercial API that looks useful – but not enough information to provide comfort as to what happens to data.
- Recommendation: Hold, review periodically.
* http://www.attachmentscanner.com/
- a commercial ($99+/month) SaaS based API.
- Recommendation: Hold, review periodically.
- Fully owned subsidiary of Google, providing free, public API limited to 4 requests of any nature per minute.
- Recommendation: Do not use for sensitive data as malware infected media is shared with virus scanning companies.
* HerdProtect:
- Installed Windows product that requires an IaaS based instance if being used in the cloud.
- Recommendation: Not fit for purpose.
* https://www.metadefender.com/:
- Provides a free SaaS service to upload small files (<140Mb) using a form.(no API)
- Recommendations:
- Maybe form post could emulated, but would probably introduce brittleness. Avoid.
- Heavy, and expensive, providing multiple lines of defense.
- Recommendations: In most cases, it's overkill.
* https://virusscan.jotti.org/
- Free Linux based SaaS based Form upload, limited to 5 files per upload with 50MB limit per file. An API is provided for bulk scanning, price unknown.
- Recommendation: A couple of online threads mention it catching less than VirusTotal. Hold.
- Their mission is to provide a free, independent and non-commercial service to the security community. They provide an online form (no API), that uses VirusTotal – and therefore sensitive/classified data may be leaked.
- Recommendation: avoid.
* https://www.hybrid-analysis.com/
- Max 100Mb
- Upload Form
- Has API
- Free upload form limited to 20Mb. No API.
- Recommendation: prefer an api based offering.
* XRay
- Installation requires an IaaS instance if being used in the cloud.
- Recommendation: not fit for purpose.
| Criteria | OPSWAT MetaDefender | ClamAV | Hybrid Analysis | Scanii | VirusTotal | Microsoft Antimalware for Azure | Microsoft Defender for Storage | McAfee ASAP | Jotti | Malwr | Virscan | Xray |
| —————————– | ———————————- | ———————————- | ———————————- | ———————————- | ———————————- | ———————————- | ———————————- | ———————————- | ———————————- | ———————————- | ———————————- | ———————————- |
| Installation | SaaS or on-prem (VM/container) | On-prem only (Linux) | SaaS only | SaaS only | SaaS only | IaaS (agent on VM) | SaaS (native to Azure Storage) | SaaS + endpoint agent | SaaS (web-based) | SaaS (archived) | SaaS (web-based) | SaaS (web-based) |
| Capabilities | Multi-engine (30+) | Single engine | Single engine + sandboxing | Single engine | Multi-engine (70+) | Single engine (MDAV) | Single engine (MDAV) | Multi-engine + DLP | Multi-engine (approx. 15) | Single engine + sandbox (legacy) | Multi-engine (approx. 30) | Multi-engine + sandbox |
| Sovereignty | US/EU (configurable); local if on-prem | Local only | US/EU (cloud) | Not region-specific | Global (not configurable) | Local to Azure region | Local to Azure region | Global (US HQ) | EU-based | Unknown (service retired) | Global | Unknown |
| Privacy | Configurable; shared by default | Fully local | Shared unless private tier used | Not shared externally | Shared by default | Sends telemetry to Microsoft | Scans in-place; no external sharing | Shared with vendor | Shared with AV vendors | Shared (historical) | Shared with AV vendors | Shared with AV vendors |
| Continuity (Corp Size) | Large (independent vendor) | Large (Cisco) | Medium (CrowdStrike-acquired) | Small to medium | Large (Google) | Large (Microsoft) | Large (Microsoft) | Large (Intel spin-off) | Small | Defunct | Small | Small |
| Cost | Commercial (~$100/month base) | Free | Free tier + commercial plans | Free tier + usage-based plans | Free tier + commercial API plans | Free (included with VM) | Pay-as-you-go (per scan) | Commercial (tiered) | Free | Free | Free | Free |
| Billing Method | Direct subscription | None | Direct subscription | Direct subscription | Direct subscription | Azure billing (included) | Azure billing (native) | Direct or enterprise licensing | None | None | None | None |
| Azure Integration | API-based only | Manual integration | API-based only | API-based; Azure SDK available | API-based only | Native to Azure VMs | Native to Azure Blob Storage | Not native | Not integrated | Not integrated | Not integrated | Not integrated |