E-mail virus detection

العناوين الأخرى

الكشف عن فايروسات الإيميل

مقدم أطروحة جامعية

al-Izzi, Suhad Abd al-Rahman Yusuf

مشرف أطروحة جامعية

George, Luayy Idwar

الجامعة

جامعة بغداد

الكلية

كلية العلوم

القسم الأكاديمي

قسم علوم الحاسبات

دولة الجامعة

العراق

الدرجة العلمية

ماجستير

تاريخ الدرجة العلمية

2004

الملخص الإنجليزي

Virus detection software is a program that knows how to find a particular repertoire of viruses.

This work aims to develop E-mail virus detection system, called Email Detection System (EDS), using three different detection methods depending on the type of possible threat that attacks E-mail files.

E-mail file structure is divided into a set of parts, the main two parts that could be attacked by a virus are body and attachment part if exist.

To perform virus detection, at first text analyzer is needed to open E-mail file and separate the main body of the messages from the attachment part (if exist).

Then analyze all possible threat that might pass through each part.

The first part is the body of E-mail messages, which could be attacked by using some Java or VBscripts commands.

This type of threat is managed by searching for () command at the first line of E-mail message, then search for specific suspicious script command (execute script, createobject(filingsystem), createobject (application program), reg.write) in the script part.

If one of these commands exists, then manage it using signature detection method.

Attachment part is decoded using Base64 (6-bit) decoder to convert it to its binary original form (8-bit).

The attachment file could be an application program (Word and Excel), Executable file (.EXE, .COM), or hypertext file (html, htt, htm).

Each of these files could face different threats, at which the application program faces macro attacks, which is managed by using detection by behavior method.

Viruses that attack the executable files are managed by heuristic detection (since existence of any JMP or CALL instruction at the beginning of file’s code section refers to a probability of virus existence) or detection by signature method.

Finally, the hypertext file faces the same E-mail body threat therefore; it is managed by signature method.

التخصصات الرئيسية

تكنولوجيا المعلومات وعلم الحاسوب

عدد الصفحات

72

قائمة المحتويات

• APA
• MLA
• AMA

لغة النص

الإنجليزية

نوع البيانات

رسائل جامعية

رقم السجل

BIM-757318