Darwin inside the machines: malware evolution and the consequences for computer security
Peter Ször Symantec
Dimitris Iliopoulos and C. Adami Keck Graduate Institute of Applied Life Sciences
Recent advances in anti-malware technologies have steered the security industry away from maintaining vast signature
databases and into newer defence technologies such as behaviour blocking, application white-listing and others. Most
would agree that the reasoning behind this is to keep up with the arms race established between malware writers and the
security community almost three decades ago. Still, malware writers have not as yet created new paradigms. For example,
malicious code evolution is still largely limited to code pattern changes utilizing polymorphic and metamorphic engines.
Each new malware instance retains the exact same core functionality as its ancestor and only alters the way it looks.
What if, instead, malware were able to change its function or behaviour autonomously? What if, in the absence of human
intervention, computer viruses resembled biological viruses in their ability to adapt to new defence technologies as soon
as they came into effect?
In this paper, we will provide the theoretical proof behind malware implementation that closely models Darwinian
evolution.
Biological viruses are under constant attack by immune systems and artificial drugs. Yet they systematically manage
to evolve new functionalities that circumvent such countermeasures, leading to recurrent epidemics. According to the
biological analogy, malware will be able to alter its functionality by autonomously incorporating behaviours freely
available to it by the numerous discoverable APIs. The new behaviour profiles would be constantly screened by security
software in the same way natural selection acts on biological organisms. In the end, the malware instances that are
better equipped to survive countermeasures will be able to proliferate more efficiently. Such malware pose a real threat
to the current methods of detection due to the vast numbers of functions they can adopt that cannot possibly be screened
for. Furthermore, it is likely that clean program functionality will be favoured amongst such behaviours since it shields
malware that is mimicking clean programs from behaviour blocking. As a consequence, we predict behaviour-based virus
detection would quickly become ineffective if malware can evolve based on the Darwinian paradigm.
