Using purpose capturing signatures to defeat computer virus mutating

Xiaoqi Jia, Xi Xiong, Jiwu Jing, Peng Liu

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Nowadays computer viruses become more and more difficult to be identified. Modern computer viruses use various mutation techniques such as polymorphism and metamorphism to evade detection. Previous researches in mutated computer virus detection have limitations in that: 1) most of them cannot handle advanced mutation techniques; 2) the methods based on source code analysis are less practical. 3) some methods are unable to detect computer viruses immediately. In this paper, we present a new dynamic approach to detect and analyze computer viruses based on Virtual Machine technology. We show that 1) how to generate Purpose Capturing Signatures based on the information of runtime values (execution value sequence, EVS) and control flows (execution control sequence, ECS); 2) how to detect and analyze computer viruses using the purpose-capturing signatures. To our best knowledge, it is the first method to perform computer virus detection and analysis using the EVS and ECS. Our experimental evaluation demonstrates that this approach is able to use one signature to detect all mutations of the corresponding virus efficiently.

Original languageEnglish (US)
Title of host publicationInformation Security Practice and Experience - 6th International Conference, ISPEC 2010, Proceedings
Pages153-171
Number of pages19
DOIs
StatePublished - 2010
Event6th International Conference on Information Security Practice and Experience, ISPEC 2010 - Seoul, Korea, Republic of
Duration: May 12 2010May 13 2010

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume6047 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other6th International Conference on Information Security Practice and Experience, ISPEC 2010
CountryKorea, Republic of
CitySeoul
Period5/12/105/13/10

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'Using purpose capturing signatures to defeat computer virus mutating'. Together they form a unique fingerprint.

Cite this