A Design for Virus Prevention and Detection Using Integrity Checking

Abstract

Current anti-virus technology is largely reactive and relying on finding a particular virus before being able to deal with it. As virus numbers increase, a reactive approach becomes ever more difficult. Most of the current antivirus products rely upon scanning. The scanning technique has several problems which include capacity problems, update requirements and polymorphic virus. Capacity problems where the number of viruses discovered is growing at an ever-increasing rate. Update requirement problem where in order for a virus to be detected by a signature scanner it must first have been discovered and included in scanner updates. And polymorphic virus problem which are viruses that modify themselves in such a way that identification using a signature becomes more difficult or even impossible. Currently, there are many different types of computer viruses; this research concentrates on the viruses that attack executable programs. A design for the prevention and detection of computer virus has been developed based upon an advanced integrity checking method. This is based upon the fact that a sufficiently advanced change-detection system, which considers all factors including system areas of the disk and the computer memory into account, has the best chance of detecting all current and future viral strains. The expected benefits of this approach are: to prevent most of the current and future viruses from infecting a computer; to integrate with the operating system to provide an extension to the operating system so as to enforce security to the operating system’s resources and to be able to detect viruses that has no known signature.