Detecting malicious codes by the presence of their "gene of self-replication"

Abstract

A high percentage of information attacks are perpetrated by deploying computer viruses and worms, which result in very costly and destructive "epidemics". Spread of malicious codes is achieved by the built-in ability to self-replicate through the Internet and computer media. Since most legitimate codes do not self-replicate, and the number of ways to achieve self-replication is limited to the order of fifty, the detection of malicious codes could be reduced to the detection of the "gene of self-replication" in the code in question. This paper present the analysis of the self-replication mechanism of one of the recent computer viruses and discusses the ways to detect the ability of a computer code to self-replicate before the execution. © Springer-Verlag Berlin Heidelberg 2003.