What kind of detection techniques is being used in antivirus software that identifies malware by collecting data from multiple protected systems and instead of analyzing files locally it’s made on the provider’s environment?

Cloud-based detection is an antivirus technique where threat analysis is offloaded from the end-user's system to the provider's cloud infrastructure. This model involves a lightweight agent on the protected system that collects data (e.g., file hashes, metadata, suspicious behaviors) and sends it to the cloud. The provider's environment then analyzes this data, often correlating information from millions of other protected systems to identify and respond to new threats rapidly. This perfectly matches the question's description of collecting data from multiple systems and performing analysis in the provider's environment rather than locally.

A. Behavioral based: This technique focuses on the actions and behavior of a program to determine if it is malicious, not on the location where the analysis is performed.

B. Heuristics based: This method uses algorithms and rules to detect potential malware based on suspicious characteristics. Its defining feature is the analytical approach, not the environment.

C. Honeypot based: This is a security mechanism that uses a decoy system to lure and study attackers. It is a threat intelligence tool, not a detection technique used on production endpoints.

1. Vinod

P. S.

Jaidhar

C. D.

& Latha

B. (2019). A Survey on Malware Detection Methods. In Proceedings of the 3rd International Conference on Computing and Communications Technologies (ICCCT). IEEE. (DOI: https://doi.org/10.1109/ICCCT2.2019.8824938). On page 2

Section III-D

the paper states

"Cloud-based scanners move malware detection from the user’s computer to the cloud... The client on the user’s computer gathers data about the files and sends it to the cloud for analysis."

2. Ussath

M.

Jaeger

D.

& F. Cheng. (2016). A Survey of Malware-Detection Methods. Hasso-Plattner-Institut

University of Potsdam

Technical Reports in Computer Science

No. 106. On page 10

Section 2.4

it describes cloud-based detection: "Instead of performing the analysis on the client

a small agent collects information about executable files and sends it to the cloud provider... The provider analyzes the data and returns a result."

3. Al-Ameen

M. A.

& Maarof

M. A. (2014). A Survey on Cloud Based Antivirus Systems. International Journal of Computer Applications

99(17)

1-6. The abstract and introduction state

"The main idea of cloud based antivirus is to move the heavy tasks of the antivirus from the client side to the server side (cloud)... It depends on collecting information from protected computers."