Computer scientists set on winning the computer virus 'cold war'

May 24, 2007

First came the virus. Then came the antivirus software. Ever since, virus programmers have been escalating their technology, trying to stay one step ahead of the computer security engineers and vice versa.

"Essentially, this is an arms race," says Somesh Jha, an associate professor of computer science at the University of Wisconsin-Madison. Jha and graduate student Mihai Christodorescu have taken the next step in that proliferation.

In collaboration with computer scientists at the University of California-Berkeley and Carnegie Mellon University, the two UW-Madison researchers have developed new software called the Static Analyzer for Executables (SAFE).

SAFE targets viruses, spyware and other malicious programs - called malware - based on their behavior. Commercial virus scanners, such as McAfee and Symantec, search programs for specific patterns, or signatures. They read through programs like a computer might search a document for a specific word. SAFE would not only pick up that one word, but would spot all of its synonyms as well.

SAFE examines the behavior of a program without running it. Then it compares the behavior with a list of suspicious behaviors, such as reading an address book and sending e-mails. The programs that perform suspicious behaviors are considered malware.

The traditional signature-based method leaves an opening for virus programmers to disguise the virus and render the commercial scanners useless. Each disguised variant has a unique signature that must be distributed. Right now, most virus scanners recommend downloading updates weekly, but more frequent updates may become necessary, he says.

"I don't think the approaches currently being used by commercial companies are going to be sustainable," Jha says.

SAFE requires updates only when viruses exhibit new behavior. It is proactive, rather than reactive.

"This is the next generation in malware detection," Jha adds.

Jha and Christodorescu began working on SAFE when they tested variations of four viruses on Norton and McAfee antivirus scanners and found that only the original variation of each virus was caught. SAFE caught all variations.

SAFE's advantages are not limited to convenience and sustainability. Programmers are beginning to write viruses that change every time they get sent to another computer. These transformations are written directly into the code, and can create infinite variations of the virus.

"[Attackers] are already becoming very sophisticated. They are using on-the-fly evasion techniques," Jha says. "As they use more sophisticated things to hide their malware, your detection has to become better and better."

Source: University of Wisconsin-Madison

Explore further: Gravity, who needs it? NASA studies your body in space

Related Stories

Gravity, who needs it? NASA studies your body in space

November 18, 2015

What happens to your body in space? NASA's Human Research Program has been unfolding answers for over a decade. Space is a dangerous, unfriendly place. Isolated from family and friends, exposed to radiation that could increase ...

Pacific preparedness

October 26, 2015

Not far from Tokyo's Imperial Palace, an alarm pierces the air. At a nearby elementary school, hundreds of children drop to the floor, scramble beneath their desks and hold on for dear life. It's March 9, 2012, two days before ...

Predictable ecosystems may be more fragile

October 7, 2015

When it comes to using our natural resources, human beings want to know what we're going to get. We expect clean water every time we turn on the tap; beaches free of algae and bacteria; and robust harvests of crops, fish ...

Recommended for you

The ethics of robot love

November 25, 2015

There was to have been a conference in Malaysia last week called Love and Sex with Robots but it was cancelled. Malaysian police branded it "illegal" and "ridiculous". "There is nothing scientific about sex with robots," ...


Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.