论文信息 - Advanced Polymorphic Techniques

Advanced Polymorphic Techniques

Nowadays viruses use polymorphic techniques to mutate their code on each replication, thus evading detection by antiviruses. However detection by emulation can defeat simple polymorphism: thus metamorphic techniques are used which thoroughly change the viral code, even after decryption. We briefly detail this evolution of virus protection techniques against detection and then study the METAPHOR virus, today’s most advanced metamorphic virus. Keywords—Computer virus, Viral mutation, Polymorphism, Metamorphism, MetaPHOR, Virus history, Obfuscation, Viral genetic techniques.

Philippe Beaucamps

[1] Éric Filiol. Computer Viruses: from Theory to Applications , 2005 .

[2] Mark A. Ludwig,et al. Computer Viruses, Artificial Life and Evolution , 1993 .

[3] Diomidis Spinellis,et al. Reliable identification of bounded-length viruses is NP-complete , 2003, IEEE Trans. Inf. Theory.

[4] Eric Filiol,et al. On the possibility of practically obfuscating programs towards a unified perspective of code protection , 2007, Journal in Computer Virology.

[5] Bruce Schneier,et al. Environmental Key Generation Towards Clueless Agents , 1998, Mobile Agents and Security.

[6] Eric Filiol,et al. Strong Cryptography Armoured Computer Viruses Forbidding Code Analysis: the Bradley Virus 1 , 2004 .

[7] Mark A. Ludwig. The Giant Black Book Of Computer Viruses , 1995 .

[8] Fred Cohen,et al. Computer viruses—theory and experiments , 1990 .

[9] Alisa Shevchenko. The evolution of self-defense technologies in malware , 2007 .

[10] Peter Szor,et al. The Art of Computer Virus Research and Defense , 2005 .

[11] John Aycock,et al. Computer Viruses and Malware , 2006, Advances in Information Security.