Biologically Inspired Defenses against Computer Viruses International Joint

Biologically Inspired Defenses against Computer Viruses International Joint Conference on Artificial Intelligence 95’ J. O. Kephart et al.

Abstract n At IBM, we are developing novel, biologically inspired anti-virus techniques. – Neural network virus detector learns to discriminate between infected and uninfected programs - commercial product – Computer immune system identifies new viruses, analyzes them automatically, and uses the results of its analysis to detect and remove all copies of the virus that are present in the system - prototype

Introduction Expert analysis by human is too slow to deal with viruses that spread globally within days or hours n Biologically inspired anti-virus techniques from defense mechanisms that biological organisms have evolved against diseases are natural n

Computer Virus n Self-replicating software entities that attach themselves parasitically to existing programs – cell - program, organism - computer – When a user executes an infected program, the viral portion of the code typically executes first. – Printing weird message, playing music, destroying data under some circumstances. – Returns control to the original program, which executes normally

Virus Detection, Removal and Analysis n Anti-virus software seeks to detect all viral infections on a given computer system and to restore each infected program to its original uninfected state, if possible – Activity monitors, Integrity management systems – Virus scanners By characteristic byte patterns( called signature ) n Expert analyzes virus, then selects signature n Require frequent update as a new virus is discovered n

Generic Detection of Viruses n Generic detection is naturally viewed as a problem in automatic pattern classification – nearest neighbor, decision tree, MLP n boot sector virus – 512 byte long – 250/4000 , 19/20 , 80% n Nearest-Neighbor – Measure: Hamming distance or edit distance – performs poorly

Feature Selection n Byte strings as features – training set with 150 512 -byte viral boot sectors includes 76500 trigrams of which typically 25000 are distinct – 150 viral and 45 non-viral training examples – Remove trigrams appearing too frequently in legitimate boot sectors and so on – 4 -cover : 50 trigram features

Classifier Training and Performance Since No negative example contains any of the feature, any positive use of the features gives a perfect classifier n Artificial negative example is generated in which that feature’s input value is 1 and all other inputs are 0. n False negative 15% n False positive 0. 02% n

Computer Immune System n Generic virus detection has 2 drawbacks – New viruses can be detected only if they have a sufficient amount of code in common with known viruses – It is incapable of aiding in the removal of a virus from an infected boot sector of file.

A Computer Immune System n Anomaly Detection – 비정상적인 상태인지 탐지 Scanning for Known Viruses n Virus Removal n Decoys n Automatic Virus Analysis n Automatic Signature Extraction n Immunological Memory n