Search

Motivated by the standard signature-based technique for detecting viruses, we explore the idea of automatically detecting malicious code using the N-gram analysis. The method is based on statistical learning and not strictly dependent on certain viruses. We propose the use of rough set theory to reduce the feature dimension. An efficient implementation to calculate relative core, based on positive region definition is presented also. The k nearest neighbor and support vector machine classifiers are used to categorize a program as either normal or abnormal. The experimental results are promising and show that the proposed scheme results in low rate of false positive. [ABSTRACT FROM AUTHOR]

A computer virus is a program that can generate possibly evolved copies of itself when it runs on a computer utilizing the machine's resources, and by some means each copy may be propagated to another computer in which the copy will have a chance to get executed. And we call a virus instance as a viral agent since it is autonomous during its execution by choosing what action to perform in the computer without a user's intervention. In the paper we develop a computational model of viral agents based on the persistent Turing machine (PTM) model which is a canonical model for sequential interaction. The model reveals the most essential infection property of computer viruses well and overcomes the inherent deficiency of Turing machine (TM) virus models in expressing interaction. It is conceivable that viral agents have much potential to evolve in various environments according to the model. Therefore we also discuss the evolution of viral agents with two existing relevant works. Keywords: Viral Agent, Persistent Turing Machine, Evolution. [ABSTRACT FROM AUTHOR]

An intelligent detect system to recognition unknown computer virus is proposed. Using the method based on fuzzy pattern recognition algorithm, a malicious executable code detection network model is designed also. This model target at Win32 binary viruses on Intel IA32 architectures. It could detect known and unknown malicious code by analyzing their behavior. We gathered 423 benign and 209 malicious executable programs that are in the Windows Portable Executable (PE) format as dataset for experiment . After extracting the most relevant API calls as feature, the fuzzy pattern recognition algorithm to detect computer virus was evaluated. [ABSTRACT FROM AUTHOR]