Intelligent detection and modeling of computer virus

Abstract EN

Computer virus is an executable piece of code that replicates and attaches itself to other computers using local files, removable media such as magnetic / optical disks, and flash memories or networks.

In addition to replication, most of viruses perform payload activities, such as displaying a message, or formatting a hard disk.

There are several types of computer viruses, namely, polymorphic viruses, stealth viruses, slow viruses, retro viruses, and multipartite viruses.

In the literature, Turing machines are used for modeling computer viruses, but this model has several defects that motivated the research for other mathematical models of computer viruses that do not suffer from these defects.

Antivirus programs, on the other hand, seek to detect all viral infections on computer systems and try to restore each infected item to its original state if possible.

Most antivirus programs are based on the processing of the extracted virus signature.

Because there are new viruses written daily, the virus signature extraction process is a time-consuming one.

In this paper, we will introduce a mathematical model for studying the phenomenon of computer viruses, and present computer virus detection systems based on the application of three different intelligent techniques, namely, neural networks, data mining, and mobile agents.

All of these systems detect viruses depending on virus behavior instead of virus signatures ; they can detect new viruses whose signatures are not extracted yet.

These techniques are implemented and tested, where they have established satisfactory detection results.