Antivirus software is essential for safe internet browsing.

Greetings.

I offer for your review only the facts (it will be up to you to decide what is what and how it all fits together :) )

Comparison of various antiviruses based on a probabilistic assessment of their quality.

Currently, there is no shortage of information regarding antivirus testing. Moreover, the test results and the ratings assigned based on these results sometimes follow opposite vectors of evaluation.
As a rule, all tests boil down to evaluating the results of checking certain antiviruses against some set of malicious objects. The objectivity of such check results depends most heavily on the following aspects:

• Availability of the virus collection or its composition to the antivirus authors
• Quality of the virus collection
• Adequacy of the virus set to real viral threats

- An antivirus whose authors know the composition of the virus collection in advance, or even better, have access to the collection itself, will always score 100 points. After all, the closer the contact between a particular antivirus and the testing experts, the better its "testing" result. Perhaps this explains such a wide variance in results across different tests?
- There are quite a few "collections" of viruses that include software modules that are only similar to viruses, but in reality are incapable of causing any harm. Most often these are programs that were infected by a virus, but subsequently the virus within them was sterilized—meaning the program was modified and the virus code no longer gains control. Such a program is no longer a malicious object, but it contains traces (signatures) of a virus's presence. If it is checked by an antivirus with primitive recognition algorithms—for example, by scanning the body of the checked object for certain signatures—then this "antivirus" will let out a victory cry, and its author will be proud that another antivirus "misses" the virus. A huge number of such examples can be given; therefore, if the quality of the collection is not verified and confirmed by independent specialists, the value of testing on such a collection will be low. Thus, primitive antiviruses will seem better than more advanced ones capable of modeling executable program code.
- Another important aspect is how adequate the chosen collection composition is to the existing threat. Again, there are a vast number of collections consisting of viruses for which the probability of landing on computers is zero. One has to deal with "testing" results using same-collector viruses held only by the antivirus author, who is very proud that this set of viruses is detected only by their antivirus and no one else! The real value of such an "antivirus" is also equal to zero.
In reality, the true value of an antivirus lies in its ability to prevent attacks from malicious objects that actually and currently threaten your computer. Unfortunately, all existing methods of testing antiviruses cannot provide such an assessment!
Below is a proposed methodology for assessing antivirus quality based on calculating the probability of an antivirus resisting attacks from malicious objects that actually threatened the computer system. The numerical value of such an assessment can be calculated using the formula:Where:
Pav - Probabilistic quality assessment of the antivirus; the closer it is to one, the better the antivirus.
Nvir - Total number of recorded malicious objects on this computer (organization).
Nbad - Number of malicious objects that the antivirus failed to detect at the time of attack.
Table 1 contains calculations of the reliability indicator (last column) for various antiviruses. The results of checking the reaction of various antiviruses to malicious objects actually encountered by the author of this publication between January 2006 and July 2007 were used as source data. The total number of recorded malicious objects was 51. The calculated reliability indicators for various antiviruses are provided in Table 1.
Unfortunately, one of the antiviruses known in Russia, Symantec (better known here as Norton antivirus), did not fit into Table 1. This is because this antivirus was added to the VirusTotal website database on January 30, 2007, which made it impossible to include its indicators in the general table. However, thanks to the flexibility of the proposed assessment methodology, Symantec's reliability could be calculated using data from recent checks.

Sincerely K0Lb@zzeR.