Anti-virus Systems Research Articles

Virus Detection using Artificial Neural Networks

A virus is defined as a program that spreads or replicates by copying itself, and generally has malicious effects. The antivirus systems used today mainly detect malware on the basis of known virus patterns, making detection of a new virus very difficult. This deficiency can be overcome by training an artificial neural network with the inputs from Portable Executable (PE) Structure of executable files, as they learn from the training data and will be able to identify unknown virus patterns. PE Structure contains various fields by which one can identify virus infected executable files from the legitimate ones without executing them, and Fisher Score can be used to select the most relevant features (fields) to speed up the analysis. A new technique of identifying virus infected files by using Fisher Score and applying them as input to the neural network is proposed. General Terms Virus, Program, Patterns, Executable files

PrEP: A Framework for Malware and Cyber Weapons

The contemporary debate over cyber security rests on a set of linguistic artifacts that date from the Cold War. Attempting to glean a starting point for debate over use of terms like “cyber attack” or “cyber war” is difficult, largely because there is little agreement on what constitutes a weapon in cyberspace, be it “weaponized code” or black hats with root access. For information security professionals, this has led to a proliferation of different taxonomies tied to proprietary anti-virus systems. To social science researchers and the policy community, the result has been unclear definitions and vague terminology, which hinder academic progress and the development of effective policy. This paper proposes a new framework to classify malware and cyber weapons based on the different pieces of malicious code that constitute them, then evaluates competing definitions of cyber weapons, and concludes with implications for this approach. As developed in this paper, Cyber Weapons are any combination of three software components: a Propagation Method, one or several Exploits, and a Payload designed to create destructive physical or logical effects. Defining malware requires a difficult balance between technical specificity and conceptual breadth. The PrEP framework attempts to combine these, while building out a set of concepts useful to both research and policy communities.

Malware Target Recognition of Unknown Threats

Organizations traditionally use signature-based commercial antivirus products as a frontline defense against malware, but advanced persistent threats craft custom malicious tools to achieve their objectives. Organizations safeguarding sensitive information have difficulty in identifying new malware threats among millions of benign executables using only signature-based antivirus systems. This paper extends a performance-based malware target recognition architecture that currently uses only static heuristic features. Experimental results show that this architectural component achieves an overall test accuracy of 98.5% against a malware set collected from operational environments, while three commercial antivirus products combine for a detection accuracy of only 60% with their most sensitive settings. Implementations of this architecture will enable organizations to self-discover new malware threats, providing enhanced situation awareness for cyberspace operators in hostile threat environments.

How Do Viruses Attack Anti-Virus Programs

As the anti-viruses run in a trusted kernel level any loophole in the anti-virus program can enable attackers to take full control over the computer system and steal data or do serious damages. Hence the anti-virus engines must be developed with proper security in mind. The ant-virus should be able to any type of specially created executable files, compression packages or documents that are intentionally created to exploit the anti-virus’s weakness.Viruses are present in almost every system even though there are anti-viruses installed. This is because every anti-virus, however good it may be, leads to some extent of false positives and false negatives. Our faith on the anti-virus system often makes us more careless about hygienic habits which increases the possibility of infection. It is necessary for an anti-virus to detect and destroy the malware before its own files are detected and destroyed by the malware.

An intelligent embedded system for malicious email filtering

Disaster from computer viruses has been ranked at the top of computer crime incidents by CSI/FBI. However, many anti-virus systems have high latency and consume a lot in the available CPU resources for malicious code filtering. Nevertheless, switching or updating anti-virus software within different operating systems is costly, tedious, and annoying. Therefore, we have proposed a standalone intelligent Embedded Email Virus Filter system to overcome these drawbacks. The associative Petri net model that integrates malicious behavior reasoning is adopted to detect the malicious executable. The experimental results show that our proposed system has great potential in email virus filtering.

Live virus-free or die: coupling of antivirus immunity and programmed suicide or dormancy in prokaryotes

BackgroundThe virus-host arms race is a major theater for evolutionary innovation. Archaea and bacteria have evolved diverse, elaborate antivirus defense systems that function on two general principles: i) immune systems that discriminate self DNA from nonself DNA and specifically destroy the foreign, in particular viral, genomes, whereas the host genome is protected, or ii) programmed cell suicide or dormancy induced by infection.Presentation of the hypothesisAlmost all genomic loci encoding immunity systems such as CRISPR-Cas, restriction-modification and DNA phosphorothioation also encompass suicide genes, in particular those encoding known and predicted toxin nucleases, which do not appear to be directly involved in immunity. In contrast, the immunity systems do not appear to encode antitoxins found in typical toxin-antitoxin systems. This raises the possibility that components of the immunity system themselves act as reversible inhibitors of the associated toxin proteins or domains as has been demonstrated for the Escherichia coli anticodon nuclease PrrC that interacts with the PrrI restriction-modification system. We hypothesize that coupling of diverse immunity and suicide/dormancy systems in prokaryotes evolved under selective pressure to provide robustness to the antivirus response. We further propose that the involvement of suicide/dormancy systems in the coupled antivirus response could take two distinct forms:1) induction of a dormancy-like state in the infected cell to ‘buy time’ for activation of adaptive immunity; 2) suicide or dormancy as the final recourse to prevent viral spread triggered by the failure of immunity.Testing the hypothesisThis hypothesis entails many experimentally testable predictions. Specifically, we predict that Cas2 protein present in all cas operons is a mRNA-cleaving nuclease (interferase) that might be activated at an early stage of virus infection to enable incorporation of virus-specific spacers into the CRISPR locus or to trigger cell suicide when the immune function of CRISPR-Cas systems fails. Similarly, toxin-like activity is predicted for components of numerous other defense loci.Implications of the hypothesisThe hypothesis implies that antivirus response in prokaryotes involves key decision-making steps at which the cell chooses the path to follow by sensing the course of virus infection.ReviewersThis article was reviewed by Arcady Mushegian, Etienne Joly and Nick Grishin. For complete reviews, go to the Reviewers’ reports section.

A novel link between Campylobacter jejuni bacteriophage defence, virulence and Guillain–Barré syndrome

Guillain-Barré syndrome (GBS) is a post-infectious disease in which the human peripheral nervous system is affected after infection by specific pathogenic bacteria, including Campylobacter jejuni. GBS is suggested to be provoked by molecular mimicry between sialylated lipooligosaccharide (LOS) structures on the cell envelope of these bacteria and ganglioside epitopes on the human peripheral nerves, resulting in autoimmune-driven nerve destruction. Earlier, the C. jejuni sialyltransferase (Cst-II) was found to be linked to GBS and demonstrated to be involved in the biosynthesis of the ganglioside-like LOS structures. Apart from a role in pathogenicity, we report here that Cst-II-generated ganglioside-like LOS structures confer efficient bacteriophage resistance in C. jejuni. By bioinformatic analysis, it is revealed that the presence of sialyltransferases in C. jejuni and other potential GBS-related pathogens correlated significantly with the apparent degeneration of an alternative anti-virus system: type II Clusters of Regularly Interspaced Short Palindromic Repeat and associated genes (CRISPR-Cas). Molecular analysis of the C. jejuni CRISPR-Cas system confirmed the bioinformatic investigation. CRISPR degeneration and mutations in the cas genes cas2, cas1 and csn1 were found to correlate with Cst-II sialyltransferase presence (p < 0.0001). Remarkably, type II CRISPR-Cas systems are mainly found in mammalian pathogens. To study the potential involvement of this system in pathogenicity, we inactivated the type II CRISPR-Cas marker gene csn1, which effectively reduced virulence in primarily cst-II-positive C. jejuni isolates. Our findings indicate a novel link between viral defence, virulence and GBS in a pathogenic bacterium.

Tamiflu-Resistant but HA-Mediated Cell-to-Cell Transmission through Apical Membranes of Cell-Associated Influenza Viruses

The infection of viruses to a neighboring cell is considered to be beneficial in terms of evasion from host anti-virus defense systems. There are two pathways for viral infection to “right next door”: one is the virus transmission through cell-cell fusion by forming syncytium without production of progeny virions, and the other is mediated by virions without virus diffusion, generally designated cell-to-cell transmission. Influenza viruses are believed to be transmitted as cell-free virus from infected cells to uninfected cells. Here, we demonstrated that influenza virus can utilize cell-to-cell transmission pathway through apical membranes, by handover of virions on the surface of an infected cell to adjacent host cells. Live cell imaging techniques showed that a recombinant influenza virus, in which the neuraminidase gene was replaced with the green fluorescence protein gene, spreads from an infected cell to adjacent cells forming infected cell clusters. This type of virus spreading requires HA activation by protease treatment. The cell-to-cell transmission was also blocked by amantadine, which inhibits the acidification of endosomes required for uncoating of influenza virus particles in endosomes, indicating that functional hemagglutinin and endosome acidification by M2 ion channel were essential for the cell-to-cell influenza virus transmission. Furthermore, in the cell-to-cell transmission of influenza virus, progeny virions could remain associated with the surface of infected cell even after budding, for the progeny virions to be passed on to adjacent uninfected cells. The evidence that cell-to-cell transmission occurs in influenza virus lead to the caution that local infection proceeds even when treated with neuraminidase inhibitors.

Defense Islands in Bacterial and Archaeal Genomes and Prediction of Novel Defense Systems

The arms race between cellular life forms and viruses is a major driving force of evolution. A substantial fraction of bacterial and archaeal genomes is dedicated to antivirus defense. We analyzed the distribution of defense genes and typical mobilome components (such as viral and transposon genes) in bacterial and archaeal genomes and demonstrated statistically significant clustering of antivirus defense systems and mobile genes and elements in genomic islands. The defense islands are enriched in putative operons and contain numerous overrepresented gene families. A detailed sequence analysis of the proteins encoded by genes in these families shows that many of them are diverged variants of known defense system components, whereas others show features, such as characteristic operonic organization, that are suggestive of novel defense systems. Thus, genomic islands provide abundant material for the experimental study of bacterial and archaeal antivirus defense. Except for the CRISPR-Cas systems, different classes of defense systems, in particular toxin-antitoxin and restriction-modification systems, show nonrandom clustering in defense islands. It remains unclear to what extent these associations reflect functional cooperation between different defense systems and to what extent the islands are genomic "sinks" that accumulate diverse nonessential genes, particularly those acquired via horizontal gene transfer. The characteristics of defense islands resemble those of mobilome islands. Defense and mobilome genes are nonrandomly associated in islands, suggesting nonadaptive evolution of the islands via a preferential attachment-like mechanism underpinned by the addictive properties of defense systems such as toxins-antitoxins and an important role of horizontal mobility in the evolution of these islands.

Effect of computer updating on spreading of worms

The updating of computers has great impact on the dynamics of worms.To contain the propagation of worms,it is necessary to characterize this factor.A model was proposed in this paper,which took account of the influence of computer updating.Furthermore,the model's equilibria and their stability conditions were obtained mathematically and then verified by simulations.The analytical and simulated results show that the updating of computers can lead to the persistence of worms,which will die out otherwise.The simulation results also show that the updating rate has bi-effects on the spreading of worms.Under the guidance of basic reproduction number,the negative effect can be alleviated and worms can be terminated by introducing a anti-virus system of high initial installation rate.

Detection of Bot Infected PC Using Destination-based IP Address and Domain Name Whitelists

As a bot communicates with a malicious controller over a normal communication or an encrypted channel and updates its code frequently, it becomes difficult to detect an infected personal computer (PC) using a signature-based intrusion detection system (IDS) and an antivirus system (AV). As sending control and attack packets from the bot process are independent of the user operation, a behavior monitor is effective in detecting an anomaly communication. In this paper, we propose a bot detection technique that checks outbound packets with destination-based whitelists. If any outbound packets during the non-operating duration do not match the whitelists, the PC is considered to be infected by the bot. The whitelists are a set of legitimate IP addresses (IPs) and/or domain names (DNs). We implement the proposal system as a host-based detector and evaluate false negative (FN) and false positive (FP) performance.

A Graphics Processing Unit Based Multi-string Matching Algorithm for Anti-virus Systems

A Graphics Processing Unit Based Multi-string Matching Algorithm for Anti-virus Systems

Machine learning in adversarial environments

Whenever machine learning is used to prevent illegal or unsanctioned activity and there is an economic incentive, adversaries will attempt to circumvent the protection provided. Constraints on how adversaries can manipulate training and test data for classifiers used to detect suspicious behavior make problems in this area tractable and interesting. This special issue highlights papers that span many disciplines including email spam detection, computer intrusion detection, and detection of web pages deliberately designed to manipulate the priorities of pages returned by modern search engines. The four papers in this special issue provide a standard taxonomy of the types of attacks that can be expected in an adversarial framework, demonstrate how to design classifiers that are robust to deleted or corrupted features, demonstrate the ability of modern polymorphic engines to rewrite malware so it evades detection by current intrusion detection and antivirus systems, and provide approaches to detect web pages designed to manipulate web page scores returned by search engines. We hope that these papers and this special issue encourages the multidisciplinary cooperation required to address many interesting problems in this relatively new area including predicting the future of the arms races created by adversarial learning, developing effective long-term defensive strategies, and creating algorithms that can process the massive amounts of training and test data available for internet-scale problems.

Novel approach for high (secure and rate) data hidden within triplex space for executable file

Steganography is an art that involves the concealing of information with the aim of making the communication invisible. Unlike cryptography, where the main aim is to secure communications from the Snooper by encoding that data in such a way that it becomes visible but not understood. In this paper, we propose a framework that will integrate both steganographic and cryptographic approaches within a hyiperd space of an EXE file. This approach will be used for highly securing data that is hidden; using both the advance encryption standard (AES) method and statistical technique (ST) computation. To further address the security issues, we will use the EXE as a cover for the hidden data; the executable file cover was selected in this approach because of its ability to hide huge amounts of data within a hyiperd space of an EXE file which in turn overcomes the problem of the data hiding quantity. The use of the EXE file also makes sure that the changes made to it will not be detected by anti-virus and its functionality will not be negatively affected after the hiding process, features of the short-term responses were simulated, and indicated that the size of the hidden data does depend on the size of the Unused Area1+ Unused Area 2 + Image Pages; within the cover file which is equal to 28% of the size of the exe.file before the hiding process. Most antivirus systems do not allow direct writing into executable files, so the approach of the proposed system is to prevent the hidden information from being disclosed by these systems and the exe.file still functioning normally after the data hiding process. Key words: Steganography, hidden data, encryption, advance encryption standard (AES).

Challenges of Hidden Data in the Unused Area Two within Executable Files

Problem statement: The executable files are one of the most important files in operating systems and in most systems designed by developers (programmers/software engineers), and then hiding information in these file is the basic goal for this study, because most users of any system cannot alter or modify the content of these files. There are many challenges of hidden data in the unused area two within executable files, which is d ependencies of the size of the cover file with the size of hidden information, differences of the size of file before and after the hiding process, availability of the cover file after the hiding pro cess to perform normally and detection by antivirus software as a result of changes made to the file. Approach: The system designed to accommodate the release mechanism that consists of two functions; f irst is the hiding of the information in the unused area 2 of PE-file (exe.file), through the execution of four process (specify the cover file, specify t he information file, encryption of the information, an d hiding the information) and the second function i s the extraction of the hiding information through th ree process (specify the steno file, extract the information, and decryption of the information). Results: The programs were coded in Java computer language and implemented on Pentium PC. The designed algorithms were intended to help in proposed system aim to hide and retract information (data fi le) with in unused area 2 of any execution file (exe.file). Conclusion: Features of the short-term responses were simulate d that the size of the hidden data does depend on the size of the unused area2 wi thin cover file which is equal 20% from the size of exe.file before hiding process, most antivirus syst ems do not allow direct write in executable file, s o the approach of the proposed system is to prevent t he hidden information to observation of these systems and the exe.file still function as usual af ter the hiding process

RIP – A robust IP access architecture

This research is of the view that only tightly coordinated work among security components as we know them today including firewalls, traffic analysis modules, intrusion detection systems, antivirus remediation systems, etc., is likely to take us closer to a more effective solution against some security threats. A structured Robust IP (RIP) access architecture is described and its components are analyzed through the use of a proof of concept testbed. Examples of the use of RIP and the heuristics it implements are evaluated. We also compare RIP performance to existing work. We show that there are currently some tradeoffs that need to be made between accuracy and responsiveness. We believe that this collaborative communication style between the components represents a significant step in the direction of self-defending networks and innovation in the area.

How bad is it?

IT security architects have great faith in their security products. Some new research from Google gives architects, and end users, something to worry about. Recently, Google researchers examined millions of web sites in an effort to determine the number of sites attempting drive-by attacks against users. Drive-by attacks can be particularly dangerous because they are designed to evade detection and strike users when they least expect it; when they're surfing the web. Unsurprisingly, Google found a large number of malicious sites are working every day to compromise users' data. What's even worse, however, is that their research paints a bleak picture of the overall state of IT security. Security products are a commodity. The use of products such as firewalls, anti-virus systems, web filters, and IDS are well understood and documented. The purchasing of security products in well integrated into the IT spending of most organisations, complete with technology refresh cycles and very competitive procurement processes. The whole process can make an enterprise feel relatively secure based on the sheer volume of time invested and dollars spent.

An intelligent PE-malware detection system based on association mining

The proliferation of malware has presented a serious threat to the security of computer systems. Traditional signature-based anti-virus systems fail to detect polymorphic/metamorphic and new, previously unseen malicious executables. Data mining methods such as Naive Bayes and Decision Tree have been studied on small collections of executables. In this paper, resting on the analysis of Windows APIs called by PE files, we develop the Intelligent Malware Detection System (IMDS) using Objective-Oriented Association (OOA) mining based classification. IMDS is an integrated system consisting of three major modules: PE parser, OOA rule generator, and rule based classifier. An OOA_Fast_FP-Growth algorithm is adapted to efficiently generate OOA rules for classification. A comprehensive experimental study on a large collection of PE files obtained from the anti-virus laboratory of KingSoft Corporation is performed to compare various malware detection approaches. Promising experimental results demonstrate that the accuracy and efficiency of our IMDS system outperform popular anti-virus software such as Norton AntiVirus and McAfee VirusScan, as well as previous data mining based detection systems which employed Naive Bayes, Support Vector Machine (SVM) and Decision Tree techniques. Our system has already been incorporated into the scanning tool of KingSoft’s Anti-Virus software.

Focus on the ESET NOD32 antivirus system

AbstractOne of the software programs we take for granted is antivirus software. Perhaps part of the reason for not being excited about protecting our computers resides in the fact that most PCs marketed over the past few years are bundled with an antivirus solution. When you initialize the computer you also start your virus protection program, which will often provide you with only a short period of protection before pop‐up messages appear reminding you to renew your antivirus program license to ensure your protection is up to date. What is more than likely never mentioned to consumers is the fact that the antivirus software bundled with your computer was positioned there due to the software vendor paying the computer manufacturer a fee. While most third‐party software placed on new computers must pass a certain level of quality assurance, the computer manufacturer is more interested in the placement fee than whether the software is the best for the purchaser of the computer. Thus, one of the things we should do when our antivirus software license expires, if not sooner, is to look at other possible solutions beyond the software bundled with the computer. One such antivirus product that warrants our attention and which is the focus of this column is ESET's NOD32 for Windows antivirus solution, which was originally developed in Slovakia.

Profiling and accelerating string matching algorithms in three network content security applications

The efficiency of string matching algorithms is essential for network content security applications, such as intrusion detection systems, anti-virus systems, and Web content filters. This work reviews typical algorithms and profiles their performance under various situations to study the influence of the number, the length, and the character distribution of the signatures on performance. This profiling can reveal the most efficient algorithm in each situation. A fast verification method for some string matching algorithms is also proposed. This work then analyzes the signature characteristics of three content security applications and replaces their original algorithms with the most efficient ones in the profiling. The improvement for both real and synthetic sample data is observed. For example, an open source anti-virus package, ClamAV, is five times faster after the revision. This work features comprehensive profiling results of typical string matching algorithms and observations of their application on network content security. The results can enlighten the choice of a proper algorithm in practical design.