virus code and then the scanning process starts. It parses statements one by one to remove unimportant statements and blank gaps and gets the skeleton of the code. The skeleton is then searched for virus signatures.

Exact Identification

In this method, more than one number of constant bytes in the virus code is searched for scanning. As a result, the number of false positives in virus detection improves much.

Heuristics Analysis

In this method, several heuristics are used to detect infections of viruses. Some commonly used heuristic flags may be :

  • The possible gap between sections
  • Suspicious section characteristics
  • Suspicious code section name
  • Multiple or suspicious PE Headers
  • Suspicious imports from kernel
  • Suspicious code redirection

Static Decryptor Detection

This method detects encrypted viruses. String scanning specific to the virus is used to detect its decryptor.

X-RAY Scanning

When an encrypted virus is first detected, the plaintext body of the particular virus is obtained. Several encryption techniques commonly used by virus writers are applied to specific parts of the plaintext code, like the top and tail of the file, entry points, etc. Using those, the signature is scanned in an unknown virus.

This technique is normally used in polymorphic viruses. However, it is very time-consuming.

Code Emulation

This technique is widely used to detect viruses. In this method, a virtual environment simulates the CPU, memory, storage resources, and some necessary functions of an Operating System, and the virus code is made to run in that environment. Once the code runs, its behavior is observed and analyzed. That information is utilized to detect new viruses.

Disadvantages of traditional virus detection techniques

Though the techniques of virus detection improved a lot over time, they have their own disadvantages, which eventually made traditional anti-virus programs ineffective. A number of them are mentioned below :

  • The signature scanning method usually maintains a database of signatures of known viruses, using which unknown viruses are scanned. But, as the number of viruses increased drastically over time, it became quite impractical to maintain such databases of virus signatures.
  • The signature database does not contain signatures of newly found viruses until they are analyzed successfully and added to the database. This makes traditional anti-virus programs quite ineffective in detecting new viruses.
  • Traditional techniques for detecting viruses are ineffective for detecting Zero-day threats.
  • Hackers often use techniques like crypters, server-side polymorphism, etc., which make it difficult for traditional anti-virus programs to detect them.

What is NGAV or the Next Generation Anti-Virus?

Next Generation Anti-Virus or NGAV is a technique that relies on machine learning to dissect new viruses in an automated way. It uses some dynamic analysis approach to detect viruses, instead of …

Facebooktwitterredditpinterestlinkedinmail

Calculate the pseudoinverse of a matrix using Python

What is the pseudoinverse of a matrix? We know that if A is a square matrix with full rank, then A-1 is said to be the inverse of A if the following condition holds: $latex AA^{-1}=A^{-1}A=I $ The pseudoinverse or the Moore-Penrose inverse of a matrix is a...

Cholesky decomposition using Python

What is Cholesky decomposition? A square matrix A is said to have Cholesky decomposition if it can be written as a product of a lower triangular matrix and its conjugate transpose. $latex A=LL^{*} $ If all the entries of A are real numbers, then the conjugate...

Tensor Hadamard Product using Python

In one of our previous articles, we already discussed what the Hadamard product in linear algebra is. We discussed that if A and B are two matrices of size mxn, then the Hadamard product of A and B is another mxn matrix C such that: $latex H_{i,j}=A_{i,j} \times...

Perform tensor addition and subtraction using Python

We can use numpy nd-array to create a tensor in Python. We can use the following Python code to perform tensor addition and subtraction. import numpy A = numpy.random.randint(low=1, high=10, size=(3, 3, 3)) B = numpy.random.randint(low=1, high=10, size=(3, 3, 3)) C =...

How to create a tensor using Python?

What is a tensor? A tensor is a generalization of vectors and matrices. It is easily understood as a multidimensional array. For example, in machine learning, we can organize data in an m-way array and refer it as a data tensor. Data related to images, sounds, movies,...

How to combine NumPy arrays using horizontal stack?

We can use the hstack() function from the numpy module to combine two or more NumPy arrays horizontally. For example, we can use the following Python code to combine three NumPy arrays horizontally. import numpy A = numpy.array([[1, 2, 3], [4, 5, 6], [7, 8, 9]]) B =...

How to combine NumPy arrays using vertical stack?

Let’s say we have two or more NumPy arrays. We can combine these NumPy arrays vertically using the vstack() function from the numpy module. For example, we can use the following Python code to combine three NumPy arrays vertically. import numpy A = numpy.array([[1, 2,...

Singular Value Decomposition (SVD) using Python

What is Singular Value Decomposition (SVD)? Let A be an mxn rectangular matrix. Using Singular Value Decomposition (SVD), we can decompose the matrix A in the following way: $latex A_{m \times n}=U_{m \times m}S_{m \times n}V_{n \times n}^T $ Here, U is an mxm matrix....

Eigen decomposition of a square matrix using Python

Let A be a square matrix. Let’s say A has k eigenvalues λ1, λ2, ... λk. And the corresponding eigenvectors are X1, X2, ... Xk. $latex X_1=\begin{bmatrix} x_{11} \\ x_{21} \\ x_{31} \\ ... \\ x_{k1} \end{bmatrix} \\ X_2=\begin{bmatrix} x_{12} \\ x_{22} \\ x_{32} \\ ......

How to calculate eigenvalues and eigenvectors using Python?

In our previous article, we discussed what eigen values and eigenvectors of a square matrix are and how we can calculate the eigenvalues and eigenvectors of a square matrix mathematically. We discussed that if A is a square matrix, then $latex (A- \lambda I) \vec{u}=0...

Amrita Mitra

Author

Ms. Amrita Mitra is an author, who has authored the books “Cryptography And Public Key Infrastructure“, “Web Application Vulnerabilities And Prevention“, “A Guide To Cyber Security” and “Phishing: Detection, Analysis And Prevention“. She is also the founder of Asigosec Technologies, the company that owns The Security Buddy.

0 Comments

Submit a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Not a premium member yet?

Please follow the link below to buy The Security Buddy Premium Membership.

Featured Posts

Translate »