The Norton Pulse Updates Feature

Summary

It’s a simple truth: The faster virus definitions are received, the better the protection is for the computer. Norton 2009 has added a new technology, called Norton Pulse Updates, which downloads new virus definitions almost as soon as they are created, without sacrificing reliability or performance.

When new virus definitions are created, they are posted right away as small Pulse Updates. Every five minutes, Norton LiveUpdate downloads the latest Pulse Updates and they are incorporated into the customer’s PC virus protection immediately.

Pulse Updates are extremely fast and run silently in the background; customers are unlikely to even notice them unless they look at “Definition Updates” on the main screen. As long as the machine is turned on and connected to the Internet, users will rarely see a last update time more than several minutes old.

The Pulse Updates mechanism is backed up by the reliability and power of Norton’s full Automatic LiveUpdate mechanism. If some Pulse Updates are missed, don’t worry; LiveUpdate will periodically bring everything up to date.

How it Works

Symantec’s Security Response team is constantly at work analyzing new viruses and writing virus definitions. When a new virus definition is written, it goes into testing to make sure it does not flag clean files as viruses. In many cases, the definition can quickly be certified as safe and effective. It is then made available for Pulse Updates.

During every Pulse Update publishing cycle - every 15 minutes or so - all such definitions which have not yet been published are compiled into a single Pulse Update package. This package replaces the current Pulse Update package on the LiveUpdate server.

Every five minutes, Norton LiveUpdate (in Pulse Update mode) checks to see if there is a new Pulse Update package on the server. If there is, it downloads the package, then takes the Pulse Updates and adds them to those already on the machine. The key here is performance – this process is designed to be extremely simple and fast.

Norton loads and uses the new definitions immediately, so the virus will be detected if it runs. It even runs a quick check to make sure the virus isn’t already running.

In addition to publishing Pulse Updates, Symantec also publishes full virus definitions packages. During every full definitions publishing cycle – about once every 8 hours – every virus definition, both new and old, is packaged into a formal versioned set. This includes all the Pulse Updates published at that point. This set is tested as a whole, and then published as many different packages. Each package contains the information necessary to update from a specific older definitions set to the new definitions set.

Every hour, as soon as the computer is idle (or every 6 hours if it is never idle), Automatic LiveUpdate checks the server for a new full definitions set. If it finds one, it will download the package appropriate to convert the full definitions set on the machine to the latest definitions set. This is the same Automatic LiveUpdate session that also checks (separately) for other kinds of updates, such as program updates.

When the full definition set is updated, it replaces all of the older Pulse Updates. Because the Pulse Updates themselves don’t need to stay on the machine for very long, LiveUpdate does not need to spend time filing and organizing them. This is one more reason why Norton LiveUpdate is able to run Pulse Updates quickly and efficiently.

Some virus definitions are more complex, requiring a longer period of time to certify as safe and effective. These definitions are tested and published as part of the full definition sets, not as Pulse Updates.

Both Pulse Updates and full Automatic LiveUpdate respect the new Silent Mode option and turn off completely when Silent Mode is turned on. If the system goes into “automatic” Silent Mode because a full screen application is running, Pulse Updates will not run and the full Automatic LiveUpdate will wait a full six hours before running.

Conclusion

Pulse Updates is an extremely fast channel to deliver virus definitions to customer’s computers without sacrificing reliability and without creating a significant performance impact.