Fighting malware and spam

Darwin inside the machines: malware evolution and the consequences for computer security

Peter Ször Symantec
Dimitris Iliopoulos and C. Adami Keck Graduate Institute of Applied Life Sciences

Recent advances in anti-malware technologies have steered the security industry away from maintaining vast signature databases and into newer defence technologies such as behaviour blocking, application white-listing and others. Most would agree that the reasoning behind this is to keep up with the arms race established between malware writers and the security community almost three decades ago. Still, malware writers have not as yet created new paradigms. For example, malicious code evolution is still largely limited to code pattern changes utilizing polymorphic and metamorphic engines. Each new malware instance retains the exact same core functionality as its ancestor and only alters the way it looks. What if, instead, malware were able to change its function or behaviour autonomously? What if, in the absence of human intervention, computer viruses resembled biological viruses in their ability to adapt to new defence technologies as soon as they came into effect?

In this paper, we will provide the theoretical proof behind malware implementation that closely models Darwinian evolution.

Biological viruses are under constant attack by immune systems and artificial drugs. Yet they systematically manage to evolve new functionalities that circumvent such countermeasures, leading to recurrent epidemics. According to the biological analogy, malware will be able to alter its functionality by autonomously incorporating behaviours freely available to it by the numerous discoverable APIs. The new behaviour profiles would be constantly screened by security software in the same way natural selection acts on biological organisms. In the end, the malware instances that are better equipped to survive countermeasures will be able to proliferate more efficiently. Such malware pose a real threat to the current methods of detection due to the vast numbers of functions they can adopt that cannot possibly be screened for. Furthermore, it is likely that clean program functionality will be favoured amongst such behaviours since it shields malware that is mimicking clean programs from behaviour blocking. As a consequence, we predict behaviour-based virus detection would quickly become ineffective if malware can evolve based on the Darwinian paradigm.

Poll

VB2010