AModelDetectingExistenceUnknoComputerVirusesReal-Time.pdfVIP

A Mo del for Detecting the Existence of Unknown Computer Viruses in Real-Time Jerey M. Voas Jeery E. Payne Reliable Software Technologies Reliable Software Technologies Penthouse Suite Penthouse Suite 1001 N. Highland Street 1001 N. Highland Street Arlington, VA 22210 USA Arlington, VA 22210 USA Dr. Frederick B. Cohen ASP PO Box 81270 Pittsburgh, PA 15217 USA Search terms: Computer viruses, Tro jan horses, Mo dels of computation, Virus detection and prevention. Abstract This paper describes a model for detecting the existence of computer viruses in real-time. 1 1 Background Protection technologies in common use [5] are capable of preventing corruption by viruses (e.g. through mandatory access control), detecting known viruses (e.g. by searching for them), detecting sp ecic typ es of corruption as it o ccurs (e.g. trapping the mo dication of executable les in certain ways), and detecting corruption b efore it causes signicant damage (e.g. through cryptographic checksums in integrity shells), but some p oints must b e made concerning their limited capabilities.  Any system that relies solely on access control to prevent corruption is no more secure than the individuals or p olicies allow it to b e. Even though sound access control p olicies against viruses exist, the vast ma jority of current systems do not implement these controls, and even if these controls are in place, current implementations are imp erfect. Even the most