The Possibilities of System’s Self-defense Against Malicious Software

Abstract

For many years the detection of malware and preparation of the ways of preventing them have been treated as two distinct issues. Malware monitoring should provide information on how to detect the presence of malware and attempts to infect the system. The protecting systems using this information should identify and stop malware operation. This paradigm led to current solutions, where protecting systems focus on detection of incoming threats and do not pay attention on the presence of not previously detected malware in the system. Malware authors have developed various methods of circumventing the defense lines of protecting systems, what results in a growing stream of information of systems security breaches. This indicates the need for additional line of defense, focused on detection of the malware, which penetrated defenses of the system. The paper presents the concept of such additional defense line, discusses the sources of necessary informations, method for detection of unknown malware and possible method of blocking malware operation.