COMPREHENSIVE METHODOLOGY FOR EVALUATING THE FUNCTIONAL CAPABILITIES OF ANTIVIRUS SOFTWARE

Abstract

In today's conditions of intensive development of information and communication technologies and rapid growth of the number of cyber threats, protection of end devices and information and communication systems of organizations is becoming critical. In this regard, antivirus software remains a key tool in ensuring cyber protection against malicious software and targeted attack scenarios. However, to choose the optimal antivirus software, it is important to have an objective and comprehensive approach to assessing their functionality. The purpose of this article is to develop a Comprehensive Methodology for Evaluating the Functional Capabilities of Antivirus Software. The proposed methodology takes into account a wide range of tests that simulate typical and atypical vectors of malware penetration: from infected ZIP archives, phishing emails, changes to system files (hosts, registry) to detection of Beacon activity, auto-start scripts, obfuscated PowerShell commands, Office document macros, etc. The study evaluates four popular antivirus software products: ESET Endpoint Security, Avast Business Antivirus, Zillya, and Windows Defender. As part of the experiment, the research team evaluated the functions of each antivirus software product according to 21 criteria. The evaluation was carried out in points (0–2) with the corresponding criticality weight (1 – critical, 0.8 – high, 0.5 – medium). The methodology allows you to determine the overall level of functionality and efficiency in percentage terms. This allows you to objectively approach the choice of antivirus software depending on the nature of the information infrastructure and the level of risk. The proposed approach is universal and suitable for adaptation to other platforms and conditions, and can also be expanded to interact with Endpoint Detection and Response (Extended Detection and Response) class systems. The results of the study confirm the importance of a comprehensive approach to cyber protection, taking into account the specifics of modern cyberattacks.