The future of software infrastructure protection

In this paper the author describes how a Gatekeeper prototype had detected 83 percent of all unknown real viruses thrown at it. Even more intriguing was that the 17 percent of viruses missed were all due to the prototype code's immaturity, rather than any failing of the method used to detect them. Stated another way: An enterprise-ready version of the prototype would have captured every virus the Internet could have thrown at it during its testing period. Of course, many signature-based virus detection tools can detect 100 percent of known viruses. But very few of them can recognize new viruses.