Computer scientists set on winning the computer virus 'cold war'

May 24, 2007

First came the virus. Then came the antivirus software. Ever since, virus programmers have been escalating their technology, trying to stay one step ahead of the computer security engineers and vice versa.

"Essentially, this is an arms race," says Somesh Jha, an associate professor of computer science at the University of Wisconsin-Madison. Jha and graduate student Mihai Christodorescu have taken the next step in that proliferation.

In collaboration with computer scientists at the University of California-Berkeley and Carnegie Mellon University, the two UW-Madison researchers have developed new software called the Static Analyzer for Executables (SAFE).

SAFE targets viruses, spyware and other malicious programs - called malware - based on their behavior. Commercial virus scanners, such as McAfee and Symantec, search programs for specific patterns, or signatures. They read through programs like a computer might search a document for a specific word. SAFE would not only pick up that one word, but would spot all of its synonyms as well.

SAFE examines the behavior of a program without running it. Then it compares the behavior with a list of suspicious behaviors, such as reading an address book and sending e-mails. The programs that perform suspicious behaviors are considered malware.

The traditional signature-based method leaves an opening for virus programmers to disguise the virus and render the commercial scanners useless. Each disguised variant has a unique signature that must be distributed. Right now, most virus scanners recommend downloading updates weekly, but more frequent updates may become necessary, he says.

"I don't think the approaches currently being used by commercial companies are going to be sustainable," Jha says.

SAFE requires updates only when viruses exhibit new behavior. It is proactive, rather than reactive.

"This is the next generation in malware detection," Jha adds.

Jha and Christodorescu began working on SAFE when they tested variations of four viruses on Norton and McAfee antivirus scanners and found that only the original variation of each virus was caught. SAFE caught all variations.

SAFE's advantages are not limited to convenience and sustainability. Programmers are beginning to write viruses that change every time they get sent to another computer. These transformations are written directly into the code, and can create infinite variations of the virus.

"[Attackers] are already becoming very sophisticated. They are using on-the-fly evasion techniques," Jha says. "As they use more sophisticated things to hide their malware, your detection has to become better and better."

Source: University of Wisconsin-Madison

Explore further: Researchers parallelize a common data structure to work with multicore chips

add to favorites email to friend print save as pdf

Related Stories

IBM and Mars join together to make food safer with genetics

Jan 30, 2015

(Phys.org)—Computer giant IBM, and food giant Mars, have announced a joint project they are calling "Consortium for Sequencing the Food Supply Chain." The idea is to use modern microbiology, computer crunching ...

Team works to counter a new class of coffee shop hackers

Jan 08, 2015

If you're sitting in a coffee shop, tapping away on your laptop, feeling safe from hackers because you didn't connect to the shop's wifi, think again. The bad guys may be able to see what you're doing just ...

Fighting cyber-crime one app at a time

Oct 22, 2014

This summer Victoria University of Wellington will be home to four Singaporean students researching cyber threats. The students have been working with Dr Ian Welch, a lecturer in Victoria's School of Engineering and Computer ...

Recommended for you

Moving big data faster, by orders of magnitude

Jan 28, 2015

In today's high-productivity computing environments that process dizzying amounts of data each millisecond, a research project named for "a trillion events per day" may seem relatively ordinary.

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.