Prevention of information attacks by run-time detection of self-replication in computer codes

Article type: Research Article

Authors: Skormin, V. | Volynkin, A. | Summerville, D. | Moronski, J.

Affiliations: Binghamton University, Binghamton NY 13902, USA. E-mail: vskormin@binghamton.edu, alex@volynkin.com, dsummer@binghamton.edu, jim@moronski.com

Abstract: This paper describes a novel approach for preventative protection from both known and previously unknown malicious software. It does not rely on screening the code for signatures of known viruses, but instead it detects attempts by the executable code in question to self-replicate during run time. Self-replication is the common feature of most malicious codes, allowing them to maximize their impact. This approach is an extension of the earlier developed method for detecting previously unknown viruses in script based computer codes. The paper presents a software tool implementing this technique for behavior-based run-time detection and suspension of self-replicating functionality in executable codes for Microsoft Windows operating systems.

Keywords: Run-time replication detection, sequences of system codes, malware detection, kerner-level monitoring

DOI: 10.3233/JCS-2007-15203

Journal: Journal of Computer Security, vol. 15, no. 2, pp. 273-302, 2007