Welcome to the second segment of our two-part story on antivirus technology. In Part 1, we provided a brief history of computer viruses and virus detection methods, followed by insights into virus signature scanning techniques. In this segment, we’ll look at heuristic scanning techniques methods used to catch unknown or more complex viruses, and we’ll study how polymorphic and metamorphic virus detection works. Let’s start with heuristic scanning.
The term heuristic (hyu-RIS-tik) comes from the Greek word heuriskein, meaning “to discover”, and describes the technique of approaching a problem through past experience, or knowledge. Technically, all forms of scanning are essentially heuristic, since AV researchers apply the knowledge of code sequences and infection locations to the signatures.
Heuristic techniques are used to find unknown viruses and threats that have not yet been cataloged with signatures. Heuristics looks at characteristics of a file, such as size or architecture, as well as behaviors of its code to determine the likelihood of an infection. Heuristics can sometimes find and stop many new viruses before they execute. It is also used to find known viruses that do not lend themselves to signatures, like some of the new metamorphic viruses that can obscure their entry points, have obfuscated code structures (that can shrink or expand themselves through their metamorphic engines), and are often encrypted as well.
When a file is scanned with a signature, the detection is positive, and it is determined to be either a specific (or family) virus or not. Although While prone to errors or false positives occur sometimes, signature scanning is pretty accurate. Heuristic techniques, on the other hand, are working on the probabilities of a file being infected. Heuristics is not an exact science. Currently, the industry claims a 70%-80% detection rate of new and unknown viruses with heuristic scanning, which is pretty good considering the complexity of the problem.
A heuristic scanner looks for dozens if not hundreds of behaviors and indicators that viruses use, and assigns a weighted score to each. Some red flags may include code to check a date, an oversized file, or attempts to access your address book. Any of these red flag indicators could simply be an innocent application, but a scorecard of sorts is created, and when a number of such occurrences are combined, it may indicate a virus. Antivirus vendors are always walking a thin line with heuristics between being too stringent and producing a lot of false positives, or too lenient and missing malicious code.
When all the scores are added up and the total exceeds a threshold, there is a high probability that the file may be a virus. The user interfaces of many AV products provide heuristic settings to control the threshold. When heuristics is turned on, most vendors default setting is the middle of the range, letting the user increase or decrease the sensitivity or threshold. Theoretically, if you turn up the sensitivity (lower the threshold), you can catch more viruses, but you will also have more false positives. If an antivirus package cries wolf too many times it won’t be used, and any benefit of it catching real viruses will be lost.
In addition to scoring of red flag activity, the use of expert systems in determining the likelihood of infection is used. These artificial intelligence techniques are similar to fraud screening methods used by credit card companies.
Heuristics can also be used in a reverse manner, looking for behaviors that couldn’t possibly be viruses, or in certain instances couldn’t possibly be specific viruses with known properties. Therefore, in some cases, it’s faster to determine that a file couldn’t contain a virus, then finding one that could. For example, with the W32.Simile virus, it contains not only the payload, but code to compile, decompile, encrypt and decrypt the virus, resulting in a bigger file. The infection is 32k to 130k in length, so a file that was 25k couldn’t contain that virus.
- 1 of 5
- Next »