Analyze and Model the Primitive Attacking Mechanisms of Malicious Codes

Abstract

So far, researches on the topic of malicious code are mainly focused on the defending models and mechanisms against them. However, understanding how malicious code works is critical to preventing it effectively. This paper investigates the attacks that most recent malicious codes exhibit. By dissecting the combined malicious logic of them, it defines computer virus, worm, Trojan horse, and data-driven attack as the primitive attacking payloads of contemporary malicious codes. Models for each of the primitive attacks are then researched. Based on F. Cohenpsilas virus definition, how computer virus infects and propagates are formally described. By analyzing the code structure of a worm program, a model for worm network is presented. At last, data-driven attack is formally defined and how it threats to system security is analyzed.