How Effective Are Anti-Viral Toolkits in Preventing Computer Virus Attacks

摘要

This study investigated the potential for coupling statistical analysistechniques with rigid experimental procedures to ascertain how effective anti-viral software toolkits are preventing computer virus attacks. A literature search revealed that no rigorous methodology existed for certifying anti-viral software which is frequently the first line of defense against computer virus attacks. Computer virus samples were-collected from a major certification testbed, underground bulletin boards that specialize in releasing computer viruses, and computer virus construction kits written by underground authors to help novices create polymorphic computer viruses with little or no previous experience. Specific areas investigated include growth trends in computer viruses since 1986, statistical techniques that are applicable to destructive procedures, and experimental protocols for testing computer viruses. A formal methodology was developed to couple statistical methods with formal experimentation. The results of the investigation demonstrate that behavior blocking technology is more effective than static analysis techniques. The investigation proves that civilian certification testbeds do not mirror the real-world virus threat. Behavior blocking technology was about 100% effective at detecting viruses.