Computer Virus Research Papers - Academia.edu (original) (raw)

— Recent research work shows that feature fusion technique is not widely used in computer virus detection. Viruses generated from kits like NGVCK are detected effectively using feature fusion approach. Our purpose is to examine various... more

— Recent research work shows that feature fusion technique is not widely used in computer virus detection. Viruses generated from kits like NGVCK are detected effectively using feature fusion approach. Our purpose is to examine various flavours of feature fusion approach in virus detection.

Computer viruses have become a major security threat to our work and home PC’s. Their complexity and quantity have increased significantly in recent years, and antivirus companies battle to deal with the solutions that detect and remove... more

Computer viruses have become a major security threat to our work and home PC’s. Their complexity and quantity have increased significantly in recent years, and antivirus companies battle to deal with the solutions that detect and remove them. The aim of the project is to improve awareness of the problem, and solutions. The nature of the work undertaken to meet this aim was a study of the viral code methods,
and to enable a corporation to detect and remove these viruses thoroughly. This involved writing suitable policies, training plans for staff and the selection of specialist software to perform these tasks correctly. The first section explains the types of viruses, the software tools to remove them and guidelines for management and staff that wish to create their own anti-virus strategy. The second section of the project involved creating a generic virus scanner for word macro viruses, the most widespread type of virus problem to date. By exploiting a
common aspect in these viruses, it is possible detect and remove most word viruses both old and new. This could be marketable as a useful anti-virus tool to help combat an increasing security risk.
In conclusion: This project was successful within the scope of the problem, and a steep learning curve was achieved to understand the issues involved. This will continue to be an area of great interest for future work and employment within the field. Published in 1999.

The term Virus was first published academically by Fred Cohen in 1984 in a scientific paper. Computer viruses have a way of working identical to biological viruses in general, so it's no wonder the naming of computer viruses takes the... more

The term Virus was first published academically by Fred Cohen in 1984 in a scientific paper. Computer viruses have a way of working identical to biological viruses in general, so it's no wonder the naming of computer viruses takes the term biology. The main characteristic of a computer virus is that a virus requires a master file to infect when replicating itself, this is what distinguishes computer viruses from other destructive computer programs. Several categories of computer virus are boot virus, program virus, multipartite virus, stealth/polymorphic virus, metamorphic virus and macro virus.The infected master file is called the host file. Today, a computer virus refers to a program that is capable of self-replicating and spreading by duplicating virus codes into the infected file or document.

Abstract - Grid Computing is a new trend being developed in Information Technology. It helps us take full advantage of processing and storing capacity and other underused resources to provide an environment of high processing capacity and... more

Abstract - Grid Computing is a new trend being developed in Information Technology. It helps us take full advantage of processing and storing capacity and other underused resources to provide an environment of high processing capacity and plentiful storing ability and using it to ...

Checksums, long used for random error detection in communications, is now being employed to detect changes for integrity purposes. For example, checksums are being used for the detection of computer viruses [POZ86]. The checksum... more

Checksums, long used for random error detection in communications, is now being employed to detect changes for integrity purposes. For example, checksums are being used for the detection of computer viruses [POZ86]. The checksum algorithms for detecting random errors are not sufficient against an entity that wishes to "fool" the checksum mechanism. This entity wants to be able to insert a forgery in place of the original data such that an unsuspecting user does not realize the forgery has occurred. This paper describes checksum algorithms and features of checksum algorithms to deter this type of forgery.

Shortcut virus is a virus which Enters in to your USB flash drive, Hard Disk drive, Memory cards or mobile phone and change your files into shortcuts with the original folder icons. The logic behind your folder becoming short cuts is... more

Shortcut virus is a virus which Enters in to your USB flash drive, Hard Disk drive, Memory cards or mobile phone and change your files into shortcuts with the original folder icons. The logic behind your folder becoming short cuts is that, this virus hides your original folders/files in the same removable media and creates the short cut with the same name. If you are also getting the only Shortcut folder when insert the usb drive, memory card on computer. And looking for solution to get rid of this virus, Here we have some tips to remove shortcut virus with format the drive or without any data loss.

tugas kelompok keamanan komputer tentang virus

This project was done as a class assignment, based on information found in different websites.

Program jahat dapat merusak sistem komputer. Semakin banyak kegunaan komputer semakin banyak juga ancaman. Ancaman-ancaman canggih terhadap sistem komputer merupakan program yang mengeksploitasi kelemahan sistem komputer. Banyak program... more

Program jahat dapat merusak sistem komputer. Semakin banyak kegunaan komputer semakin banyak juga ancaman. Ancaman-ancaman canggih terhadap sistem komputer merupakan program yang mengeksploitasi kelemahan sistem komputer. Banyak program jahat yang bisa masuk ke dalam computer yang digunakan menjadi ancaman bagi user. Ancaman itu dibagi menjadi dua kategori, yaitu : 1. Program-program yang memerlukan host program, merupakan program yang tidak dapat berdiri sendiri pada suatu program aplikasi, program utilitas, atau program sistem. 2. Program-program yang tidak memerlukan host program, merupakan program sendiri tidak memerlukan inang yang dapat dijadwalkan oleh sistem operasi. Taksonomi Bowles menghasilkan tipe-tipe program jahat : 1. Bacteria Bacteria adalah suatu program yang mengkonsumsi sumber daya sistem dengan mereplikasi dirinya sendiri. Tujuannya hanya satu yaitu mereplikasi dirinya. Pada program bacteria yang sederhana bacteria hanya bias mengeksekusi dua kopian dirinya secara simultan pada sistem multiprogramming atau menciptakan dua file baru masing-masing kopian file program bacteria kemudian mengkopi dua kali. Bacteria melakukan reproduksi secara eksponensial, dengan cepat mengambil alih pada seluruh kapasitas pemroses. Memori atau ruang disk sehingga mengakibatkan penolakan pengaksesan pengguna ke sumber daya. 2. Virus Virus komputer merupakan buatan mansia yang dapat merugikan orang lain. Virus adalah kode yang ditempelkan dalam satu program yang menyebabkan pengopian dirinya disisipkan ke satu program lain atau lebih. Program menginfeksi program-program lain dengan memodifikasi program itu, termasuk memasukkan kopian program virus yang dapat menginfeksi program lainnya. Selain itu virus biasanya melakukan fungsi yang tak diinginkan. Pada lingkingan jaringan, kemampuan mengakses aplikasi dan layanan-layanan komputer lainnya termasuk fasilitas sempurna penyebaran virus. 3. Worm Worm merupakan program yang dapat mereplikasikan dirinya kemudian mengirim kopian-kopian dari komputer ke komputer lain melalui hubungan jaringan. Begitu tiba,

By Rodrigo Ruiz, researcher at CTI Renato Archer and Rogério Winter, Colonel at Brazilian Army We present the proof of concept of a new cyber weapon that has the potential to paralyze an entire nation with irreversible damage, caused by... more

By Rodrigo Ruiz, researcher at CTI Renato Archer and Rogério Winter, Colonel at Brazilian Army
We present the proof of concept of a new cyber weapon that has the potential to paralyze an entire nation with irreversible damage, caused by nation state-sponsored attacks (Ministry of Justice of Georgia 2011) or terrorists. Apoc@lypse Technique removal of pages in the book ‘Apoc@lypse: The End of Antivirus’ (Ruiz, et al., 2015) clearly demonstrates the fragility of our defences. We were taught for more than 30 years that in the digital age, we should trust our antivirus system and always keep it updated. You can control the antivirus market and turn it against your opponent, since to do so protects your family photos, even those that protect our trade, finance and military strategies. Undetectable, fast and devastating for the computer data hit.

This electronic edition of The Little Black Book of Computer Viruses is copyright 1996 by Mark A. Ludwig. This original Adobe Acrobat file may be copied freely in unmodified form. Please share it, upload it, download it, etc. This... more

Convergence of cyberspace and terrorism, that is cyberterrorism, might be an underrated issue for the moment due to the absence of real world examples. However, the ongoing transformation from old to new terrorism and changing perceptions... more

Convergence of cyberspace and terrorism, that is cyberterrorism, might be an underrated issue for the moment due to the absence of real world examples. However, the ongoing transformation from old to new terrorism and changing perceptions of war and state security proves the opposite. Cyberterrorism is a resourceful, innovative, and an unconventional way to produce unpredictable and online threats against the traditional state marked by strict physical borders. Due to the significance of new terrorism for state security and IR, it is important to understand why current definitions are remaining to be ambiguous, complex, and insufficient in combating future cyberterrorist threats. Characterizing such a complicated phenomenon might not be an easy task, whilst without knowing what cyberterrorism is, and what it is not, we cannot develop better solutions or generate better responses for state security. Departing from these concerns, this thesis asks: what could be the proper definition for cyberterrorism? The aim is to provide a new, operational framework to address lacking insights in the current literature.

khái niệm về virus máy tính, phân biệt một số thuật ngữ trong tin học.

To investigate the use of classical epidemiological models for studying computer virus propagation we described analogies between computer and population disease propagation using SIR (Susceptible-Infected-Removed) epidemiological models.... more

To investigate the use of classical epidemiological models for studying computer virus propagation we described analogies between computer and population disease propagation using SIR (Susceptible-Infected-Removed) epidemiological models. By modifying these models with the introduction of anti-viral individuals we analyzed the stability of the disease free equilibrium points. Consequently, the basal virus reproduction rate gives some theoretical hints about how to

In this research, we present a new method, termed F-Sign, for automatic extraction of unique signatures from malware files. F-Sign is primarily intended for high-speed network traffic filtering devices that are based on deep-packet... more

In this research, we present a new method, termed F-Sign, for automatic extraction of unique signatures from malware files. F-Sign is primarily intended for high-speed network traffic filtering devices that are based on deep-packet inspection. Malicious executables are analyzed using two approaches: disassembly, utilizing IDA-Pro, and the application of a dedicated state machine in order to obtain the set of functions comprising the executables. The signature extraction process is based on a comparison with a common function repository. By eliminating functions appearing in the common function repository from the signature candidate list, F-Sign can minimize the risk of false-positive detection errors. To minimize false-positive rates even further, F-Sign proposes intelligent candidate selection using an entropy score to generate signatures. Evaluation of F-Sign was conducted under various conditions. The findings suggest that the proposed method can be used for automatically generating signatures that are both specific and sensitive.

Virus komputer merupakan program komputer yang dapat menggandakan atau menyalin dirinya sendiri dan menyebar dengan cara menyisipkan salinan dirinya ke dalam program atau dokumen lain pada sebuah sistem komputer. Sama dengan virus pada... more

Virus komputer merupakan program komputer yang dapat menggandakan atau menyalin dirinya sendiri dan menyebar dengan cara menyisipkan salinan dirinya ke dalam program atau dokumen lain pada sebuah sistem komputer. Sama dengan virus pada manusia, virus komputer dianalogikan sebagai perusak sistem di komputer. Jika terus dibiarkan dalam sistem komputer, virus akan dapat merusak sistem bahkan merusak perangkat secara keseluruhan. Tak hanya itu, berbagai jenis virus komputer yang ada dapat menghapus file, mencuri data, dan dengan mudahnya menginfeksi perangkat lain di jaringan. Hampir 95% virus komputer berbasis sistem operasi Windows. Sisanya menyerang Linux/GNU, Mac, FreeBSD, OS/2 IBM, dan Sun Operating System. Terdapat berbagai jenis virus komputer yang diketahui dapat membahayakan perangkat komputer. Jenis-jenis virus komputer ini patut Anda waspadai jika muncul pada sistem komputer Anda. Lebih lanjut, berikut Liputan6.com rangkum dari berbagai sumber, Senin (18/3/2019) jenis-jenis virus komputer. Jenis virus komputer dari cara kerjanya Dari cara kerjanya, jenis virus komputer dikategorikan sebagai berikut: Worm Worm merupakan virus komputer yang tidak terlalu berbahaya. Namun apabila dibiarkan terus menerus, maka virus ini dapat membuat penyimpanan komputer penuh dengan cepat dan membuat sistem komputer menjadi rapuh. Virus ini dapat menggandakan diri dengan cepat dan dapat membuat file acak tak berguna pada komputer. Hal inilah yang menyebabkan memori dan hardisk akan penuh dengan virus ini. Virus worm ini dapat menginfeksi komputer yang menggunakan email dan terhubung dalam jaringan internet, hal ini sama dengan yang dilakukan oleh virus Trojan. Trojan Jenis virus komputer ini dibuat dengan kemampuan mengontrol, mengendalikan data atau bahkan mencuri data yang ada pada komputer. Sama halnya dengan virus Worm, virus Trojan ini biasa muncul melalui jaringan internet dan juga email yang diterima oleh pengguna serta data pribadi yang tidak di-password. Tujuan dari Trojan adalah memperoleh informasi dari target seperti password, kebiasaan user yang tercatat dalam system log, data, dan mengendalikan target. Backdoor Backdoor merupakan jenis virus komputer yang hampir sama dengan trojan. Namun, Backdoor bisanya menyerupai file yang baik-baik saja misalnya game. Backdoor merujuk kepada mekanisme yang dapat digunakan untuk mengakses sistem, aplikasi, atau jaringan, selain dari mekanisme yang umum digunakan seperti melalui proses logon atau proses autentikasi lainnya.

The term Virus was first published academically by Fred Cohen in 1984 in a scientific paper. Computer viruses have a way of working identical to biological viruses in general, so it's no wonder the naming of computer viruses takes the... more

The term Virus was first published academically by Fred Cohen in 1984 in a scientific paper. Computer viruses have a way of working identical to biological viruses in general, so it's no wonder the naming of computer viruses takes the term biology. The main characteristic of a computer virus is that a virus requires a master file to infect when replicating itself, this is what distinguishes computer viruses from other destructive computer programs. Several categories of computer virus are boot virus, program virus, multipartite virus, stealth/polymorphic virus, metamorphic virus and macro virus.The infected master file is called the host file. Today, a computer virus refers to a program that is capable of self-replicating and spreading by duplicating virus codes into the infected file or document.

Trojan horse is said to be one of the most serious threats to computer security. A Trojan horse is typically separated into two parts – a server and a client. It is the client that is cleverly disguised as significant software and... more

Trojan horse is said to be one of the most serious threats to computer security. A Trojan horse is typically separated into two parts – a server and a client. It is the client that is cleverly disguised as significant software and positioned in peer-to-peer file sharing networks, or unauthorized download websites. The most common means of infection is through email attachments. In order to distribute the virus to unsuspecting users, the developer of the virus usually uses various spamming techniques. Malware developers use chat software as another method to spread their Trojan horse viruses such as Yahoo Messenger and Skype. This study aims to analyze and detect the behavior of Trojan attacks, provide ways on how to prevent, detect, and recover from Trojan attacks.

Hwa A. Lim, "The Internet - Human-computer symbiosis", Symbiosis, February-April 2005, pp. 22-25.

Computer virus programs are generally perceived to be a threat to the information stored by computer users. This research evaluated the impact computer viruses have on information stored by computer users. The emphasis was on the effects... more

Computer virus programs are generally perceived to be a threat to the information stored by computer users. This research evaluated the impact computer viruses have on information stored by computer users. The emphasis was on the effects of computer viruses rather than on the detail of their operation. The main hypotheses involved the question of whether or not computer viruses do pose a threat to the information stored by computer users. The effect of computer viruses on the information of users in industry was measured by sending a questionnaire to 388 companies country-wide. &~ average of 2l,5% of the respondents claimed detrimental effects to information stored on disk due to computer viruses. This and other data was used to guide laboratory experiments on the actual damage done by computer viruses to stored information. A set of test disks was prepared to represent programs and data of a typical PC user in industry. Fifteen different virus programs were used individually to infect the test disks. After each infection, all the test disks were inspected to ascertain damage to data, system and program files as well as to separate disk sectors. The research established that: The damage done by computer viruses to stored information is generally limited to one file or disk area. Where damage to stored information did occur, it was often reversible. Irrational user responses to virus symptoms provide a large potential source for damage to stored information. The availability of master program disks (for program file restoration) and recent, validated data backup is essential to recovery from a computer virus infection. A user can solve most problems caused by virus infections if he has a basic understanding of disk structure, i.e. tracks, sectors, sides, the FAT, etc, and of the use of disk utility programs like Norton Utilities or PCTools. The fact that some of the findings of prominent virus researchers could not be verified, suggests that virus programs could be unstable. Claims regarding the damage inflicted by viruses must be considered to be valid only for a specific copy of the virus under discussion. The importance of using original application software (to minimize the transfer of viruses and to enable program file restoration) , regular back-ups (to enable data file restoration) and basic user awareness (infection prevention, symptoms, the use of anti-viral and utility programs, etc.) was emphasized. The average PC user should be able to clear up a virus infection without assistance by following the given disinfection procedure. Suggestions for further study include virus origins, generations, mutations, multiple infections, and the effect of viruses on computer networks.

Metamorphic viruses engage different mutation techniques to escape from string signature based scanning. They try to change their code in new offspring so that the variants appear non-similar and have no common sequences of string as... more

Metamorphic viruses engage different mutation techniques to escape from string signature based scanning. They try to change their code in new offspring so that the variants appear non-similar and have no common sequences of string as signature. However, all versions of a metamorphic virus have similar task and performance. This obfuscation process helps to keep them safe from the string based signature detection. In this study, we make use of instructions statistical features to compare the similarity of two hosted files probably occupied by two mutated forms of a specific metamorphic virus. The introduced solution in this paper is relied on static analysis and employs the frequency histogram of machine opcodes in different instances of obfuscated viruses. We use Minkowski-form histogram distance measurements in order to check the likeness of portable executables (PE). The purpose of this research is to present an idea that for a number of special obfuscation approaches the presented solution can be used to identify morphed copies of a file. Thus, it can be applied by antivirus scanner to recognize different versions of a metamorphic virus.