Norton Insight whitelists files based on reputation. Norton-branded antivirus software then leverages the data to skip known files during

virus A virus is a submicroscopic infectious agent that replicates only inside the living cells of an organism. Viruses infect all life forms, from animals and plants to microorganisms, including bacteria and archaea. Since Dmitri Ivanovsky's 1 ...

scans. Symantec claims quicker scans and more accurate detection with the use of the technology.

Development

Insight was codenamed ''Mr. Clean''. Its initial aim was to help users determine what programs from the

Internet The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...

are safe to install. Mr. Clean would provide a risk assessment to discern between safe and malicious files. However, its goal was later changed to making virus scans more efficient; instead of scanning every file, known files are skipped, cutting scanning times.

Basic introduction & usage

Norton Community Watch, a voluntary and anonymous service, allows a user's Norton product to forward information to Symantec servers. Among the data collected are the processes running and their

SHA256 SHA-2 (Secure Hash Algorithm 2) is a set of cryptographic hash functions designed by the United States National Security Agency (NSA) and first published in 2001. They are built using the Merkle–Damgård construction, from a one-way compression ...

values. A reappearing hash value and its corresponding file are whitelisted, and Norton Insight checks the processes on a user's computer against the whitelist. Matching processes are excluded from scanning. When a process is "trusted", it has been deemed safe and excluded from risk scanning. There are two trust levels; "standard" and "high". The third option is to disable Norton Insight. In standard trust, processes appearing in the majority of participants' computers are deemed safe. High trust, in addition, excludes digitally signed files from scanning.

Tamper protection

Norton analyzes the NTFS file system upon startup, and if unaccounted changes are found, trust values of the processes on the system are revoked. In the case of a mistake, a revocation mechanism was implemented, where clients receive a list of revoked SHA256 values via LiveUpdate. If the client has a file matching a SHA256 and is currently trusting that file, all trust is revoked, and the file is once again scanned. Norton File Insight was a feature released in Norton 2010 products.

Norton file/download insight

The Norton Download Insight feature, provides insight of the files that you download and install in your computer. While the File Insight give you the reputation information, and locates the file on your computer, as well a feature that copies the information to the users clipboard. It supports the Norton Download Insight Feature, and assizes a reputation about the file. The File Insight window provides the following information: * The file type and the file name * The date on which file was installed * The date on which file was last used * The lineage details of the file * The actions that the file performs on your system * The level at which the file uses the resources of your computer * The performance impact that it has * The stability of the file for the specific operating system * The version of the file * Who developed the file?

Issues

Upon release the Download Insight program would erroneously flags a downloaded file as having no

Digital Signature A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature, where the prerequisites are satisfied, gives a recipient very high confidence that the message was created b ...

and no version number and therefore a potential threat.

Reception

The Tech Herald, which tested

Norton Internet Security 2009 Norton Internet Security, developed by NortonLifeLock, Symantec Corporation, is a discontinued computer program that provides malware protection and removal during a subscription period. It uses Antivirus software#Signature-based detection, signa ...

, found Insight affected system performance while whitelisting files. After scans, the publication also noted total number of files scanned and the number of trusted (skipped) files varied each scan. The average amount of time Insight took to scan a 561 megabyte folder with 21,816 clean files was 0:00:24:41. Despite the oddities, the editor observed Norton Internet Security 2009 was faster than subsequent products.Ragan, Steve
"Review: Norton Internet Security 2009"
The Tech Herald, October 2, 2008, accessed July 25, 2009.

References

External links

Norton Video: Norton InsightWhat is Norton Insight?
{{Symantec Norton (software) Gen Digital software Antivirus software Proprietary software