DOCSLIB.ORG

Characterizing Antivirus Workload Execution

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Characterizing Antivirus Workload Execution Characterizing Antivirus Workload Execution Derek Uluski, Micha Moffie and David Kaeli Computer Architecture Research Laboratory Northeastern University Boston, MA {duluski,mmoffie,kaeli}@ece.neu.edu Abstract head is introduced if we enable anti-virus scan- ning. Many users are unhappy with the per- Despite the pervasive use of anti-virus (AV) formance penalty they must pay for security. software, there has not been a systematic The amount of overhead introduced can be study of the characteristics of the execution of so significant that many users will defer virus this workload. In this paper we present a char- scanning or totally disable their anti-virus soft- acterization of four commonly used anti-virus ware. Then their system will be vulnerable to software packages. Using the Virtutech Simics viruses. Thus, it is important to address the toolset, we profile the behavior of four popu- performance overhead associated with anti- lar anti-virus packages as run on an Intel Pen- virus software execution. tiumIV platform running Microsoft Windows- Most anti-virus software packages employ a XP. range of scanning techniques to decide whether In our study, we focus on the overhead in- or not a given file is infected. More complex troduced by the anti-virus software during on- techniques also exist such as: sandboxing, dig- access execution. The overhead associated ital watermarking, and heuristic-based tech- with anti-virus execution can dominate overall niques [11]. performance. The AV-Test group has already There are two main usage models when run- reported that this overhead can range from 23- ning anti-virus software, 1) on-demand,and2) 129% on live systems running on-access exper- 1 on-access. The on-demand model involves the iments [3]. The performance impact of the user specifying which files to scan. In this case, anti-virus execution is clearly an important is- the anti-virus software will usually be running sue, and we present the first quantitative study for a period of time, scanning numerous files. of the characteristics of this workload. Our On-demand scanning is usually performed of- study includes the impact of both operating fline, when the user does not use the com- system execution and system call execution. puter. The on-access model can be thought of as a daemon process that monitors system- 1 Introduction level and user-level operations and intervenes (scans) when a predefined event occurs. Most Security is an important issue for all com- AV software is configured to run in on-access puter users. A significant amount of over- mode. In this paper we will focus on execution overhead associated with an on-access model. 1Comparison tests were done during 2001-02 on ear- lier versions of the anti-virus packages. We are using The rest of this paper is organized as fol- more recent versions of these packages. lows. First, we present data showing the per- formance penalty due to anti-virus execution They compared the impact of running a range in section 3. In section 4 we discuss our Sim- of anti-virus scenarios. Another comparison ics environment and in section 5 we present of different anti-virus software can be found some results from our workload characteriza- in [5]. tion. We conclude the paper in section 6. There have been a few studies that have proposed solutions to overcome anti-virus ex- 2 Related work ecution overhead. In [9], the authors ana- lyze the underlying algorithms of open source Many methods exist today that are used to anti-virus projects [1, 2] and propose a CAM- guard against virus attacks. Anti-virus pack- based co-processor for boosting anti-virus soft- ages are commonly used to guard against know ware execution performance. In [10], Syman- viruses. Most anti-virus software packages em- tec (the developers of Norton Anti-Virus) de- ploy signature matching as the main mecha- scribe a anti-virus scanning hardware mech- nism to identify viruses [11]. An alternative anism that would exist on a telecommunica- strategy involves behavior blocking, wherein tions network. They suggest using a finite the behavior of a binary is analyzed and the state machine to match multiple signatures. rate of connections to a new host is lim- Tatari [12] describes the implementation of a ited [14]. Mechanisms that execute untrusted co-processor that is capable of simultaneously software in a sandbox, while monitoring be- matching complex regular expressions. havior, are described in [11]. Next, we will present a number of charac- An important class of software-based intru- teristics of anti-virus software execution. sions include stack smashing attacks [6, 15]. This class of attacks enables an intruder to redirect execution to malicious code by over- 3 Anti-virus performance writing the return address that is stored on degradation the program call stack. Stack smashing at- tacks can be addressed in several ways. Stack- Next we will quantify the amount of overhead Guard [7] is a compiler-based approach which introduced by anti-virus software. We will de- places a canary key next to the return ad- fer a discussion of the details of our evaluation dress on the program stack and validates the framework until section 4. Figure 1 plots the integrity of the return address. LibSave [4] increase in execution time due to anti-virus presents a method where special libraries are overhead. We study three different test sce- loaded dynamically that intercept calls to narios: 1) copying a small executable from known, unsafe functions. the CDROM to the hard disk, 2) executing Hardware-based solutions for stack smash- calc.exe, and 3) executing wordpad.exe. All ing also exist. StackGhost [8] provides a of this execution is running under Windows hardware-based stack protection; the hard- XP professional. The value shown in each bar ware is responsible for encrypting and decrypt- is the percent increase in execution time rela- ing return addresses. Another approach de- tive to a base case (the base case is the same scribed in [15] enhances the return stack ad- scenario run without any anti-virus software dress to detect buffer overflow attacks. present). In the area of anti-virus software characteri- We conducted a second experiment to de- zation, the AV-Test group has published on- termine the number of extra instruction exe- line results of measuring the overhead asso- cuted while performing file system operations ciated with different anti-virus softwares [3]. and while loading/executing a binary. Both copy 450% Copy (total) calc 40 400% wordpad s) Copy (Freq. AV code) 350% 35 Execute (total) 300% 30 250% 25 Execute (Freq. AV code) 200% 20 150% 15 100% % increase in cycles in % increase 10 50% 5 0% # dynamnic instructions (in million (in instructions dynamnic # Cillin F-Prot McAfee Norton 0 Base Cillin F-Prot McAfee Norton Figure 1: Anti-virus performance degradation. Figure 2: Anti-virus overhead. scenarios involve a small Helloworld binary of anti-virus execution. 28KB in size. Next, we will discuss our simulation envi- Most of the anti-virus code executed is lo- ronment for this characterization work. cated in tight loops that perform string scans. We have found that anti-virus execution is 4 Simulation framework dominated by a very small number of very hot basic blocks in each anti-virus package: 3 ba- To study anti-virus behavior, it only makes sic blocks for Cillin and F-Prot, and less than sense to use a platform where a majority of the 20 basic blocks for McAfee and Norton (con- virus attacks have been targeted, and where taining 109 and 226 instructions total, respec- there exist a number of commercial anti-virus tively). packages available. We have chosen to build In figure 2, we plot the number of dynamic our studies on top of the Virtutech Simics instructions executed. We show the total num- toolset [13], a full machine-state architectural ber of instructions executed (total) and also simulator that can emulate a faithful model of the number instructions executed that reside a large number of micro-architectures. Sim- in hot basic blocks. We consider a basic block ics allows us to profile the complete instruc- as hot if it is visited more than 50,000 times. tion stream executed by the processor (includ- We collect all the virtual addresses, labeling ing operating system and library execution), each basic block as hot and cold, and compute as well as capture all memory and I/O activ- the percentage of instructions executed that ity. The Simics toolset also includes a cycle- reside in hot basic blocks. accurate micro-architectural model which we For Cillin, McAfee and Norton, the scanning use to obtain cycle-accurate performance num- algorithm used has a relatively small footprint bers. and is frequently revisited. This opens the The Simics model we are using is known door for optimizing the most frequent basic as the Dredd model, a 2GHz Intel PentiumIV blocks, which may lead to a significant reduc- with 256MB of memory. This model contains a tion in the performance penalty introduced by generic motherboard containing a model of the Processor Model Intel Pentium 4 2.0A Processor Operating Frequency 2GHz L1 Trace Cache 12K entry L1 Data Cache 8KB L2 Cache 512KB Main Memory 256MB Table 1: Structure of the P4 microarchitecture used in this work. Intel 440BX chipset. The goal in modeling this XP professional (2002). This is the Base con- class of machine is to capture the execution of figuration and it has no anti-virus software in- an anti-virus software on a representative sys- stalled. We then created four more configura- tem. In order to obtain performance metrics, tions on top of the Base configuration, one for the instruction stream executed is passed to each anti-virus software package.
Load more

Recommended publications
  • DEFINICIÓN Un Antivirus
    ANTIVIRUS DEFINICIÓN Un antivirus es un programa de computadora cuyo propósito es combatir y erradicar los virus informáticos. Para que el antivirus sea productivo y efectivo hay que configurarlo cuidadosamente de tal forma que aprovechemos todas las cualidades que ellos poseen. Hay que saber cuales son sus fortalezas y debilidades y tenerlas en cuenta a la hora de enfrentar a los virus. Un antivirus es una solución para minimizar los riesgos y nunca será una solución definitiva, lo principal es mantenerlo actualizado. Para mantener el sistema estable y seguro el antivirus debe estar siempre actualizado, tomando siempre medidas preventivas y correctivas y estar constantemente leyendo sobre los virus y nuevas tecnologías. ¿CÓMO FUNCIONA? Básicamente, un antivirus compara el código de cada archivo con una base de datos de los códigos (también conocidos como firmas o vacunas) de los virus conocidos, por lo que es importante actualizarla periódicamente a fin de evitar que un virus nuevo no sea detectado. También se les ha agregado funciones avanzadas, como la búsqueda de comportamientos típicos de virus (técnica conocida como Heurística) o la verificación contra virus en redes de computadores. Normalmente un antivirus tiene un componente que se carga en memoria y permanece en ella para verificar todos los archivos abiertos, creados, modificados y ejecutados en tiempo real. Es muy común que tengan componentes que revisen los adjuntos de los correos electrónicos salientes y entrantes, así como los scripts y programas que pueden ejecutarse en un navegador web (ActiveX, Java, JavaScript). ALGUNOS ANTIVIRUS 1 CLAM ANTIVIRUS Comodo AntiVirus FProt Antivirus FSecure AntiVirus ZoneAlarm Antivirus ANTIVIRUS HEURISTICOS Los heurísticos analizan el código de cada archivo con métodos genéricos y detectan virus nuevos que todavía no se han incluido en la base de datos de virus del programa antivirus.
    [Show full text]
  • Clam Antivirus: Open-Source Virus Protection
    Clam Antivirus: Open-Source Virus protection Michaël Van Canneyt March 16, 2014 Abstract Protecting your precious PC against email and other viruses doesn’t have to cost a lot of money: Clam Antivrus is an open source virus scanner which can be installed on Unix machines (suitable for integration in mail server’s MTAs) but which also has a Windows version for those that are not fortunate enough have a Unix at hand. Introducing Clam Antivirus Clam Antivirus is an open-source implementation of a virus scanner which does 1 thing only: it scans a file for known viruses. The virus scanner consists of 2 parts: One is the actual scanner, clamscan: It scans a file to see whether it is infected with a known virus. It reports on the found viruses. The known viruses are kept in a database file. The second part (freshclam) serves to keep this database up-to-date: new viruses are born every day, and existing viruses mutate to more dangerous forms regularly, it is therefore of the utmost importance to keep the database with virus definitions up-to-date. The freshclam program should be run on a regular basis, for instance in a cron job on Unix. The Unix version features also a client/server model: The scanner runs as a daemon. The clamscan program then sends the file to be scanned to the daemon, for inpection. This reduces startup time and system load, which is quite important on servers than run a heavy- load MTA service. On Windows, a small GUI frontend exists which allows to perform and schedule scans, and to perform and schedule the virus database update.
    [Show full text]
  • Linux Security Review 2015
    Linux Security Review 2015 www.av-comparatives.org AV-Comparatives Linux Security Review Language: English May 2015 Last revision: 26 th May 2015 www.av-comparatives.org -1- Linux Security Review 2015 www.av-comparatives.org Contents Introduction ....................................................................................................................... 3 Reviewed products ............................................................................................................... 4 Malware for Linux systems ..................................................................................................... 5 Linux security advice ............................................................................................................ 6 Items covered in the review .................................................................................................. 7 Avast File Server Security ...................................................................................................... 8 AVG Free Edition for Linux.................................................................................................... 11 Bitdefender Antivirus Scanner for Unices ................................................................................ 13 Clam Antivirus for Linux ....................................................................................................... 17 Comodo Antivirus for Linux .................................................................................................. 20 Dr.Web Anti-virus for
    [Show full text]
  • Anti-Virus Outbreak Response Testing and Impact
    Insecurity in Security Software Maik Morgenstern Andreas Marx AV-Test GmbH http://www.av-test.org Virus Bulletin 2005 Conference presentation about “Insecurity in Security Software” Copyright © 2005 AV-Test GmbH, Klewitzstr. 6, D-39112 Magdeburg, Germany Phone: +49 391 6075460, Fax: +49 391 6075469, http://www.av-test.org Table of content z The paradox z Types of security software z Comparison of CVE advisories z Examples of bugs and security vulnerabilities z Why bugs occur z Vulnerability lifecycle z What to do? (for users and developers) z Trustworthy computing security development lifecycle The paradox z All software products contain security vulnerabilities (and other bugs) z AV software is widely deployed to protect companies, organizations and home users z Every week, security flaws are discovered in different AV products z The paradox: Security software is meant to secure the system, but nowadays it introduces new security holes. Types of security software z Two different groups of security software: – Home and business user software (widely used) z Firewalls z IPSec products z IDS/IPS z AV software… – Tools used by researchers (small deployment) z IDA Pro z OllyDbg z Softice… CVE advisories for vendor products (2001 quarterly average = 100, Source: © The Yankee Group) z Microsoft / Security vendors / All vendors Bugs leading to security vulnerabilities z A couple of examples from recent months (advisory titles): – ISS and the Witty Worm – Trend Micro VSAPI ARJ parsing – McAfee Virus Library – Symantec Multiple Products UPX Parsing Engine Heap Overflow – Computer Associates Vet Antivirus Library Remote Heap Overflow – Kaspersky AntiVirus "klif.sys" Privilege Escalation Vulnerability – OllyDbg "INT3 AT" Format String Vulnerability – DataRescue IDA Pro Dynamic Link Library Format String Vulnerability – Clam AntiVirus ClamAV Cabinet File Handling DoS Vulnerability Bugs vs.
    [Show full text]
  • Clam Antivirus 0.100.2 User Manual Contents 1
    Clam AntiVirus 0.100.2 User Manual Contents 1 Contents ClamAV User Manual, 87d 88d 89d c 2018 Cisco Systems, Inc. Authors: Tomasz Kojm This document is distributed under the terms of the GNU General Public License v2. Clam AntiVirus is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. ClamAV and Clam AntiVirus are trademarks of Cisco Systems, Inc. 1 Introduction 2 1 Introduction Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, designed espe- cially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The core of the package is an anti-virus engine available in a form of shared library. 1.1 Features • Licensed under the GNU General Public License, Version 2 • POSIX compliant, portable • Fast scanning • Supports on-access scanning (Linux only) • Detects over 1 million viruses,
    [Show full text]
  • An Innovative Custom Cyber Security Solution for Protecting Enterprises and Corporates’ Assets
    An Innovative Custom Cyber Security Solution for Protecting Enterprises and Corporates’ Assets Karim Ouazzane*, Markson Aigbodi, Daniel Mitchell, Vassil Vassilev School of Computing, London Metropolitan University E-mail: [email protected], [email protected], [email protected], [email protected] Jun Li Department of Oncology, University of Oxford E-mail: [email protected] Abstract Anti-virus software has been the main defense against malicious application and will remain so in the future. However the strength of an anti-virus product will depend on having an updated virus signature and the heuristic engine to detect future and unknown virus. The time gap between an exploit appearing on the internet and the user receiving an update for their anti-virus signature database on their machine is very crucial. Having a diverse multi-Engine anti-virus scanner in the infrastructure with the capability for custom signature definition as part of a defence in-depth strategy will help to close that gap. This paper presents a technique of deploying more than one anti-virus solution at different layers and using custom anti-virus signature which is deployed in a custom proxy solution as part of a defence in-depth strategy. Keywords: Anti-virus, ClamAV, Malware, defence in-depth, Portable Executable (PE), Cyber security. Introduction Malicious applications like virus, worm, Trojan, Spamming and phishing tools can infect and destroy information in a user’s computer through means that the user utilizes in communicating on the internet. Email, File attachment, web surfing or file transfer on the internet either with a desktop or a smart phone are just a few of the many ways that potential harmful applications called Malware (Norton, 2012) can be introduced into the network.
    [Show full text]
  • Antivirus Software Anti Virus
    ANTIVIRUS SOFTWARE ANTI VIRUS Antivirus (or anti-virus) software is used to prevent, detect, and remove malware, including computer viruses, worms, and Trojan horses. Such programs may also prevent and remove adware, spyware, and other forms of malware 6/20/2012 TechReg-WelkinRaja HISTORY OF ANTIVIRUS Most of the computer viruses that were written in the early and mid '80s were limited to self-reproduction and had no specific damage routine built into the code (research viruses) The first publicly documented removal of a computer virus in the wild was performed by Bernd Fix in 1987. Fred Cohen, who published one of the first academic papers on computer viruses in 1984, started to develop strategies for antivirus software in 1988 that were picked up and continued by later antivirus software developers. 6/20/2012 TechReg-WelkinRaja IDENTIFICATION METHODS There are several methods which antivirus software can use to identify malware. Signature based detection Heuristic-based detection 6/20/2012 TechReg-WelkinRaja SIGNATURE BASED DETECTION Signature based detection is the most common method. To identify viruses and other malware, antivirus software compares the contents of a file to a dictionary of virus signatures. This can be very effective, but cannot defend against malware unless samples have already been obtained and signatures created. Because of this, signature-based approaches are not effective against new, unknown viruses. Because new viruses are being created each day, the signature-based detection approach requires frequent
    [Show full text]
  • Clam Antivirus 0.88.2 User Manual Contents 1
    Clam AntiVirus 0.88.2 User Manual Contents 1 Contents 1 Introduction 6 1.1 Features.................................. 6 1.2 Mailinglists................................ 7 1.3 Virussubmitting.............................. 7 2 Base package 7 2.1 Supportedplatforms............................ 7 2.2 Binarypackages.............................. 8 2.3 Dailybuiltsnapshots ........................... 10 3 Installation 11 3.1 Requirements ............................... 11 3.2 Installingonashellaccount . 11 3.3 Addingnewsystemuserandgroup. 12 3.4 Compilationofbasepackage . 12 3.5 Compilationwithclamav-milterenabled . .... 12 4 Configuration 13 4.1 clamd ................................... 13 4.1.1 On-accessscanning. 13 4.2 clamav-milter ............................... 14 4.3 Testing................................... 14 4.4 Settingupauto-updating . 15 4.5 Closestmirrors .............................. 16 5 Usage 16 5.1 Clamdaemon ............................... 16 5.2 Clamdscan ................................ 17 5.3 Clamuko.................................. 17 5.4 Outputformat............................... 18 5.4.1 clamscan ............................. 18 5.4.2 clamd............................... 19 6 LibClamAV 20 6.1 Licence .................................. 20 6.2 Features.................................. 20 6.2.1 Archivesandcompressedfiles . 20 6.2.2 Mailfiles ............................. 21 Contents 2 6.3 API .................................... 21 6.3.1 Headerfile ............................ 21 6.3.2 Databaseloading . .. .. .. .. .. .
    [Show full text]
  • 2. Malware 3. ແນະນຳ Antivirus Software 4. Some of Information
    ຢຊ ຸເກະ ຄຕິ ະມຣຸ ະ Yusuke Kitamura 1. “Information security” ແມ່ ນຫງັ ຄ? 2. Malware 3. ແນະ ນຳ Antivirus software 4. Some of information attack 5. ກຳນຉ້ ຬຄລະວັ ຄຫນ້ ຬງຫ ່ນຄ “Information security” ຅ືກໃຫ້ຉວາມຫມາຆກາຊຮັກສາຄ ໍ່ ມາ3ຂອງຂໍ່າວສາຊໂ຃ຆISO/IEC27000 series. Confidentiality: Only person who has been allowed access to information can access information Integrity: To secure the state where information is not destroyed, altered or eliminated Availability: To be able to run system to continue ->ISMS(Information Security Management System) Malware is malicious code or software created with the intention of illegal and harmful operation. Computer virus: Program that spreads by infecting other files and act wrong Trojan horse: Gives a hacker remote access to a targeted computer system Worm: standalone malware program that replicates itself in order to spread to other computers Spyware: Software that collects user information and automatically sends it to information collector If you use USB, which is effective way against malware infection? 1. Connected through a USB hub, not a socket of main body. 2. Insert the USB while holding down SHIFT key. 3. Format USB before store data. ຃ຳຉຬບ:2!! 1. Connected through a USB hub, not a socket of main body. 2. Insert the USB while holding down SHIFT key. 3. Format USB before store data. E-mail Internet USB P2P software(Share, Winny) Short-cut virus Virus infect Degital camera (SD card) Flashback (infect MacOS) Macro virus (word, excel file) ເສງ຃່ ຳ Software Trend Micro Norton AntiVirus McAfee ESET NOD32 Kaspersky Anti-Virus ໃຫ້ ລ້ ຳ Software (ຈຽວໃຆ້ ສ່ ວນຉົ ວ) Avast! antivirus Avira Antivirus AVG Anti-Virus ໃຫ້ ລ້ ຳ Software(ໃຆ້ ວຽກໄຈ້ ) COMODO Internet Security Clam Antivirus Microsoft Security Essential Wiretapping: To use illegally obtain personal information, such as password.
    [Show full text]
  • Wazuh Ruleset
    [email protected] https://wazuh.com Wazuh Ruleset Rule Description Source Updated by Wazuh apache Apache is the world's most used web server software. Out of the box ✔ AppArmor is a Linux kernel security module that allows the system administrator to restrict programs's capabilities with per -program apparmor Out of the box ✔ profiles. arpwatch ARPWatch is a computer software tool for monitoring Address Resolution Protocol traffic on a computer network. Out of the box ✔ asterisk Asterisk is a software implementation of a telephone private branch exchange (PBX). Out of the box ✔ attack_rules.xml Signatures of different attacks detected by Wazuh Out of the box ✔ cimserver Compaq Insight Manager Server Out of the box ✔ cisco-ios Cisco IOS is a software used on most Cisco Systems routers and current Cisco network switches. Out of the box ✔ Clam AntiVirus (ClamAV) is a free and open-source, cross-platform antivirus software tool-kit able to detect many types of malicious clam_av software. Out of the box ✔ courier IMAP/POP3 server Out of the box ✔ dovecot Dovecot is an open-source IMAP and POP3 server for Linux/UNIX-like systems, written primarily with security in mind. Out of the box ✔ Dropbear is a software package that provides a Secure Shell-compatible server and client. It is designed as a replacement for standard dropbear OpenSSH for environments with low memory and processor resources, such as embedded systems. Out of the box ✔ FirewallD provides a dynamically managed firewall with support for network/firewall zones to define the trust level of networ k firewalld connections or interfaces.
    [Show full text]
  • Apoc@Lypse: the End of Antivirus
    Apoc@lypse: The End of Antivirus Rodrigo Ruiz Rogério Winter Kil Park Fernando Amatte i We are grateful to pixabay.com and Isabela Ganzert Ruiz for the images. We are grateful to CreateSpace. iii Technical Revision Kil Park Rogério Winter Rodrigo Ruiz Fernando Amatte Organization and Research Rodrigo Ruiz Codes Rodrigo Ruiz designed all codes in this book. Fernando Amatte created code to accelerate the development of bacterium packer system. Chapters by Author Rodrigo Ruiz wrote chapters 6, 7 8, 9, and 10, coauthored by Rogério Winter. Kil Park wrote chapters 2, 3, and 4. Rogério Winter wrote the Introduction and chapters 1, 11, and 12, coauthored by Rodrigo Ruiz. Fernando Amatte wrote chapter 5. Translation to English Rogério Winter Copyright © 2015 by Victoria Ganzert All the rights reserved. No part of the book may be reproduced in any form, by photostat, microfilm, xerography, or any other means, or incorporated into any information retrieval system, electronic or mechanical, without the written permission of the copyright owner. ISBN: 1514863677 ISBN-13: 978-1514863671 Library of Congress Control Number: 2015912081 LCCN Imprint Name: CreateSpace Independent Publishing Platform, North Charleston, SC 5 6 DEDICATION Rodrigo Ruiz To Victoria and Isabela, who are my reasons for living. Rogério Winter To Viviane and Henrique for the love, support, and dedication in the cheerful moments and in the most difficult moments of our lives. I love you two. To my parents, Ewaldo and Ana Maria, for their dedication, education, and support. Kil Park To my parents, for every single thing that is important in my life.
    [Show full text]
  • Increasing Chances of Survival for Malware Using Theory of Natural Selection and the Selfish Gene
    INCREASING CHANCES OF SURVIVAL FOR MALWARE USING THEORY OF NATURAL SELECTION AND THE SELFISH GENE Can Yıldızlı Submitted to the Graduate School of Sabancı University in partial fulfillment of the requirements for the degree of Master of Science Sabancı University August, 2011 INCREASING CHANCES OF SURVIVAL FOR MALWARE USING THEORY OF NATURAL SELECTION AND THE SELFISH GENE Approved by: Assoc. Prof. Dr. Albert Levi .............................. (Dissertation Supervisor) Prof. Dr. Bulent¨ Yener .............................. (Dissertation Supervisor) Assoc. Prof. Dr. Erkay Savas¸ .............................. Assoc. Prof. Dr. Osman Ugur˘ Sezerman .............................. Assoc. Prof .Dr. Yucel¨ Saygın .............................. Date of Approval: ................... c Can Yıldızlı 2011 All Rights Reserved INCREASING CHANCES OF SURVIVAL FOR MALWARE USING THEORY OF NATURAL SELECTION AND THE SELFISH GENE Can Yıldızlı Bilgisayar Bilimi ve Muhendisli¨ gi,˘ Yuksek¨ Lisans Tezi, 2011 Thesis Supervisors: Albert Levi & Bulent¨ Yener Keywords: Zararlı yazılımlar, botnet, bencil gen, dogal˘ sec¸ilim Ozet¨ Zararlı yazılım terimi genel olarak bilgisayar virusleri¨ , truva atları, kurtc¸uklar ve diger˘ zarar verici program veya kodu belirtmek ic¸in kullanılır. Zararlı yazılımı kodlayan kis¸iler antiviruslerin¨ bulamaması ic¸in kodlarını gizlemeye c¸alıs¸ırlar. Antivirusler¨ s¸ifreleme ve gi- zleme yontemlerini¨ bulabilmek ic¸in degis¸ik˘ teknikler kullanmaktadırlar. Zararlı yazılımın bas¸ka bilgisayarlara bulas¸abilmesi, bulas¸tıgı˘ makinanın kaynaklarını kullanması ve kendi kopyasını c¸ıkarabilmesi ic¸in hayatta kalması saldırganın bas¸lıca ilgilendigi˘ konudur. Darwin’in dogal˘ sec¸ilim teorisi ve Richard Dawkins’in bencil gen konseptinden yola c¸ıkarak zararlı yazılımın hayatta kalma s¸ansını arttıracak yeni yontemler¨ anlatılmıs¸tır. Bencillik, fedakarˆ davranıs¸, taklitcilik, grup sec¸ilimi ve benzer davranıs¸modelleri denek zararlı yazılımımıza eklenmis¸tir ve onerilen¨ teknikler mevcut c¸oz¨ umlere¨ kars¸ı test edilmis¸tir.
    [Show full text]