A behavior based approach to virus detection

摘要: Fast spreading unknown viruses have caused major damage on computer systems upon their initial release. Current detection methods lacked capabilities to detect quickly enough avoid mass and damage. This dissertation has presented a behavior based approach detecting known attempt replicate. Replication is the qualifying fundamental characteristic of virus consistently present in all making this applicable belonging many classes executing under several conditions. A form replication called self-reference replication, (SR-replication), been formalized as one main type which specifically replicates by modifying or creating other files system include itself. was used attempting referencing themselves necessary step successfully replicate files. The does not require priori knowledge about viruses. Detection accomplished at runtime monitoring currently processes Two implementation prototypes SRRAT were created tested Microsoft Windows operating focusing tracking user mode Win32 API calls Kernel services. research results showed SR-replication capable distinguishing between file infecting benign with little no false positives negatives.