E-mail virus detection

Other Title(s)

الكشف عن فايروسات الإيميل

Dissertant

al-Izzi, Suhad Abd al-Rahman Yusuf

Thesis advisor

George, Luayy Idwar

University

University of Baghdad

Faculty

College of Science

Department

Department of Computer Science

University Country

Iraq

Degree

Master

Degree Date

2004

English Abstract

Virus detection software is a program that knows how to find a particular repertoire of viruses.

This work aims to develop E-mail virus detection system, called Email Detection System (EDS), using three different detection methods depending on the type of possible threat that attacks E-mail files.

E-mail file structure is divided into a set of parts, the main two parts that could be attacked by a virus are body and attachment part if exist.

To perform virus detection, at first text analyzer is needed to open E-mail file and separate the main body of the messages from the attachment part (if exist).

Then analyze all possible threat that might pass through each part.

The first part is the body of E-mail messages, which could be attacked by using some Java or VBscripts commands.

This type of threat is managed by searching for () command at the first line of E-mail message, then search for specific suspicious script command (execute script, createobject(filingsystem), createobject (application program), reg.write) in the script part.

If one of these commands exists, then manage it using signature detection method.

Attachment part is decoded using Base64 (6-bit) decoder to convert it to its binary original form (8-bit).

The attachment file could be an application program (Word and Excel), Executable file (.EXE, .COM), or hypertext file (html, htt, htm).

Each of these files could face different threats, at which the application program faces macro attacks, which is managed by using detection by behavior method.

Viruses that attack the executable files are managed by heuristic detection (since existence of any JMP or CALL instruction at the beginning of file’s code section refers to a probability of virus existence) or detection by signature method.

Finally, the hypertext file faces the same E-mail body threat therefore; it is managed by signature method.

Main Subjects

Information Technology and Computer Science

No. of Pages

72

Table of Contents

• APA
• MLA
• AMA

Language

English

Data Type

Arab Theses

Record ID

BIM-757318