A Classification of Viruses Through Recursion Theorems

Bonfante, Guillaume; Kaczmarek, Matthieu; Marion, Jean-Yves

doi:10.1007/978-3-540-73001-9_8

Cited by 20 publications

(22 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The key idea is the migration from abstract virology to a more operational context. The purpose is similar to the recent imperative programming language introduced by Bonfante et al in order to study the implementation of their theoretical results [22]. Unfortunately, they do not consider interactions and parallelism, which leaves some place for possible improvements.…”

Section: A Formal Semantic Based On Interactive Machines For Malware mentioning

confidence: 98%

Malware as interaction machines: a new framework for behavior modelling

Jacob

Filiol²,

Debar

2008

J Comput Virol

View full text Add to dashboard Cite

Several semantic-based malware analyzers have recently been put forward, each one defining its own model to capture the code behavior. All these semantic models, and abstract virology models likewise, fundamentally rely on formalisms equivalent to Turing Machines. However, as stated by recent advances in computer theory, these same formalisms do not capture appropriately interactions and concurrency. Unfortunately, malware, adaptable and resilient by essence, are likely to use these mechanisms intensively. In this paper, we thus extend the malware models to the specifically designed Interaction Machines. We first introduce two formal definitions for the interactive and the distributed viruses. According to different classes of interactions, their detection complexity is strongly impacted. Based on interactive languages, we then design an operational framework to describe malicious behaviors. Descriptions for some representative behaviors are given to complete and assess this framework.

show abstract

Section: A Formal Semantic Based On Interactive Machines For Malware mentioning

confidence: 98%

Malware as interaction machines: a new framework for behavior modelling

Jacob

Filiol²,

Debar

2008

J Comput Virol

View full text Add to dashboard Cite

show abstract

“…For example, Cohen describes viral behaviour using Turing machines [8], Adleman uses first-order logic [1] and Bonfante et al [3,4] base their approach on recursion theorems. Our approach differs in that the focus is not the virus's behaviour, but rather on the ecology of the virus, i.e., the environment in which reproduction takes place.…”

Section: Comparison With Other Approachesmentioning

confidence: 99%

“…[20,21] and Wehner [39] present classifications of malware based on phylogenetic trees, in which the lineage of computer viruses can be traced and a "family tree" of viruses constructed based on similar behaviours. Bonfante et al [3,4] give a classification of computer viruses based on recursion theorems. Gheorghescu [13] gives a method of classification based on reuse of code blocks across related malware strains.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Formal affordance-based models of computer virus reproduction

Webster

Malcolm

2008

J Comput Virol

View full text Add to dashboard Cite

We present a novel classification of computer viruses using a formalised notion of reproductive models based on Gibson's theory of affordances. A computer virus reproduction model consists of: a labelled transition system to represent the states and actions involved in that virus's reproduction; a notion of entities that are active in the reproductive process, and are present in certain states; a sequence of actions corresponding to the means of reproduction of the virus; and a formalisation of the actions afforded by entities to other entities. Informally, an affordance is an action that one entity allows another to perform. For example, an operating system might afford a computer virus the ability to read data from the disk. We show how computer virus reproduction models can be classified according to whether or not any of their reproductive actions are afforded by other entities.We give examples of reproduction models for three different computer viruses, and show how reproduction model classification can be automated. To demonstrate this we give three examples of how computer viruses can be classified automatically using static and dynamic analysis, and show how classifications can be tailored for different types of antivirus behaviour monitoring software. Finally, we compare our approach with related work, and give directions for future research.

show abstract

“…-Parasitic obfuscation that is used to append, prepend, or insert code into data sections of files on disk [4]. -Self-modification that allows malware to modify its code during every infection.…”

Section: Evading Virus Detection Technologiesmentioning

confidence: 99%

Malware Behavior Modeling with Colored Petri Nets

Jasiul

Szpyrka

Śliwa

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Part 9: Various Aspects of Computer SecurityInternational audienceWe propose a solution which provides a system operator with a mechanism that enables tracking and tracing of malware behavior which – in consequence – leads to its detection and neutralization. The detection is performed in two steps. Firstly single malicious activities are identified and filtered out. As they come from the identification module, they are compared with malware models constructed in the form of Colored Petri nets. In this article we present our approach to malware modeling. Proposed method was implemented and practically verified in laboratory environment with emulated malicious activity at the hosts level

show abstract

A Classification of Viruses Through Recursion Theorems

Cited by 20 publications

References 14 publications

Malware as interaction machines: a new framework for behavior modelling

Malware as interaction machines: a new framework for behavior modelling

Formal affordance-based models of computer virus reproduction

Malware Behavior Modeling with Colored Petri Nets

Contact Info

Product

Resources

About