Computer Viruses and Malware phần 4 pps

... polymorphic viruses. A histogram can also be used to detect metamorphic viruses by comparing the emulation histogram to histograms of known metamorphic viruses. ^^^ 64 COMPUTER VIRUSES AND MALWARE ... hash table 80 COMPUTER VIRUSES AND MALWARE Static heuristics • Pro: Static heuristic analysis detects both known and unknown viruses. • Con: False positives are a...

Ngày tải lên: 14/08/2014, 18:20

... Monitors/Blockers 71 4. 2.2 Emulation 74 4. 3 Comparison of Anti-Virus Detection Techniques 79 4. 4 Verification, Quarantine, and Disinfection 80 4. 4.1 Verification 81 4. 4.2 Quarantine 82 4. 4.3 Disinfection ... 3.2 .4 Oligomorphism 3.2.5 Polymorphism 3.2.6 Metamorphism 3.2.7 Strong Encryption Virus Kits viii COMPUTER VIRUSES AND MALWARE 21 22 27 28 28 30 33...

Ngày tải lên: 14/08/2014, 18:20

... code and infecting it, as shown below. The target code is locally accessible to the machine where the virus 24 COMPUTER VIRUSES AND MALWARE 15 Cooke et al. [79] looks at botnet evolution, and ... discovering these details is unusual. 16 COMPUTER VIRUSES AND MALWARE access and the costs incurred to clean up from it. He was fined, and sentenced to probation and...

Ngày tải lên: 14/08/2014, 18:20

... 94 COMPUTER VIRUSES AND MALWARE 143 Nachenberg [217]. 144 These first two heuristics are from Nachenberg [220], the third from [221]. 145 Nachenberg [222]. 146 Natvig [225] and Szor ... 4a4f484e ; is checksum of bytes 0-500 = 4a4f484e? CVDL description ; looks for two words in virus' data : example,'"painfully" AND "contrived",! Figu...

Ngày tải lên: 14/08/2014, 18:20

Ngày tải lên: 14/08/2014, 18:20

... instructions are scattered, and linked together by unconditional jumps: 44 COMPUTER VIRUSES AND MALWARE call SI call S2 SI: rl = 12 r2 = r3 r4 = rl return S2: rl = 12 r2 = 34 rS = rl return ... diverge. 42 COMPUTER VIRUSES AND MALWARE start: rl = 12 r2 = 34 r3 = rl + r2 => LI: r2 = 34 goto L2 start: rl = 12 goto LI L2: r3 = rl + r2 The...

Ngày tải lên: 14/08/2014, 18:20

... found, and defenses to these weak- nesses are examined. Where possible, weaknesses and defenses are presented in a language- and architecture-independent way. 1 24 COMPUTER VIRUSES AND MALWARE ... attacker: 108 COMPUTER VIRUSES AND MALWARE 1 14 Hasson [139] andCrackZ [81]. 115 See Rosenberg [268] for more information on this and single-stepping. 116 Hasson [1...

Ngày tải lên: 14/08/2014, 18:20

... Gragg [127], and Granger [128]. 150 COMPUTER VIRUSES AND MALWARE 136.159 University of Calgary network Computer Science subnet Specific computer on subnet Figure 7 .4. IP address ... "easily," or "widely." 14 Yet. 15 This technique of finding "blind" buffer overflows is described in [ 84, 1 94] . 132 COMPUTER VIRUSES AND...

Ngày tải lên: 14/08/2014, 18:20

... [ 346 ]. 110 Vogt [337]. Ma et al. [190] analyze self-stopping worms in great detail. 111 Hindocha and Chien [ 142 ]. 112 Nazarioetal. [230]. 113 Hypponen [150]. 1 54 COMPUTER VIRUSES AND ... network traffic to gather information about:^^^ 1 64 COMPUTER VIRUSES AND MALWARE packet's header has the sender and receiver information, and its data contains t...

Ngày tải lên: 14/08/2014, 18:20

... 1 04 Predator worms and their effects are studied in Toyoizumi and Kara [323], and Gupta and DuVarney [1 34] . 105 These issues are discussed at length by Bontchev [40 ]. 106 White [ 344 ]. ... and Heidemann [63]. 127 Jung et al. [156] and Ptacek and Newsham [256]. 128 Jung et al. [156] and Whyte et al. [ 345 ]. 186 COMPUTER VIRUSES AND MALWARE Notes for...

Ngày tải lên: 14/08/2014, 18:20