There is always a big contest between virus creators and anti-virus experts, and it is getting more and more complicated every day. Virus writers keep trying new tactics to infect systems, and security experts always find a way to overcome them. The battle continues.

Computer Viruses have evolved a lot since they were first developed, and with that evolved their concealment tactics. As a result, traditional anti-virus programs gradually started becoming ineffective. Next Generation Anti-Virus or NGAV is a technology that uses dynamic analysis instead of static ones to overcome the shortcomings of traditional Anti-virus programs.

Computer Viruses and Their Concealment Techniques

Computer Viruses take different techniques to conceal themselves so that they remain undetected by the Anti-virus programs. Several such strategies are given below:

Encryption

Encryption is the most primitive approach virus writers take to evade detection. Encrypted viruses consist mainly of two parts: a decryptor and the virus body. The virus’s actual code is encrypted in the virus body, and the decryptor decrypts the virus body and transfers the control of execution to it.

As said, the main purpose of encryption is to avoid detection by anti-virus programs. Many anti-virus programs use static analysis to analyze the virus’s code and use that to detect a virus. If the virus’s main body is encrypted, it becomes difficult for security experts to analyze and detect it.

Sometimes, encryption is also used in viruses to prevent unintentional tampering of the code of the virus.

Oligomorphism

Though encryption in viruses makes virus detection more difficult, it did not prove to be good enough for avoiding detection. Anti-virus programs often analyze known viruses and find out unique signatures or patterns in the virus code, using which the particular virus gets detected. So, once an encrypted virus is successfully analyzed and the signature is obtained, the anti-virus programs can use that to detect new infections. So, if the decryptor of the virus remains the same in the new infections, it would become easier to detect the virus.

Oligomorphism is a technique used by virus writers in which the decryptor loop keeps changing in …