Virus Bulletin Conference: Industry unveils unified naming for virus threats

By Kelly Ellis, Dublin

Posted on 7 Oct 2005 at 09:46

A new initiative set up to dispel confusion over virus-naming, the Common Malware Enumeration (CME), was launched on Wednesday.

The industry group, backed by a string of global security companies, aims to provide a common name for high profile threats in the hope that customers will be able to protect their computers from malware attacks more effectively.

The need for a more uniform approach to virus-naming has been a long-standing issue for users. Many have grown increasingly frustrated with different anti-virus vendors relying on different naming conventions to refer to particular threats.

Companies signed up to the CME will work to apply the same identifier to each piece of malware discovered by the group. It will use identifiers that will follow the format of CME-N, where N is a unique series of numerical digits. The name will be adopted by the anti-virus vendors, which can then be used in products and websites.

'Historically, regulating virus naming has proven difficult for security vendors, because of the need to issue threat protection as quickly as possible to customers,' said Mark Harris, director of virus research centre SophosLabs, 'This initiative will benefit customers involved in securing their computers from malware attacks without disrupting the serious work of rapid virus analysis and protection.

However, doubters in the industry have said that in practice the system will not work. David Perry, global director of education at Trend Micro, told panelists at the Virus Bulletin Conference in Dublin that he expects the fast-paced nature of combating viruses will render the scheme somewhat ineffective.

'The problem is you get a virus sample and you have to have something going on in 15 minutes,' he said, 'You have to name it, work out how to handle it and then kick it back out ... Now every piece of malware will end up with just 18 names and a number.'

Larry Bridwell, content security programs manager at ICSA Labs, defended the scheme by saying that at least the CME will provide users with a useful clarification tool that has not existed have before.

'CME was never designed to solve the naming process,' he countered, 'It is really designed to be a biological encyclopaedia ... it is definitely a step in the right direction.'

Members participating in the scheme so far are: McAfee, Computer Associates International, ICSA Labs, F-Secure, Kaspersky Lab, MessageLabs, Norman, Microsoft Corporation, Sophos, Symantec and Trend Micro.

For more information go to: http://cme.mitre.org.