NetNews Usenet Archive 1993 #3/NN_1993_3.iso/spool/comp/virus/4961

Internet Message Format | 1993-01-23 | 4.4 KB

Path: sparky!uunet!cs.utexas.edu!zaphod.mps.ohio-state.edu!pacific.mps.ohio-state.edu!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: [e-mail] (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: How to measure polymorphism
Message-ID: <[e-mail]>
Date: 14 Jan 93 10:54:40 GMT
Sender: [e-mail]
Lines: 77
Approved: [e-mail]

[e-mail] (Declan Malone) writes:

> Let me explain.  What polymorphism is, essentially, is a term
> describing randomness, true?  Now how do you measure randomness in an
> objective way?  You can't really, and the irony of it is that the more
> you try, and the more objective/detailed your description becomes, the
> more you are taking away from the central essence of the word `random'
> or sending your definition in the wrong direction. It seems to be the

Well, yes, but if you show two polymorphic mechanisms to a human virus
expert, he is usually able to tell which one is more polymorphic... I
was thinking about some objective way to provide such evaluations...

> You say that there is a real need for an objective way of measuring
> the level of polymorphism, but why is that so? If a user has a new
> virus running loose on his system, it is of little interest to him
> whether it is more or less random than another virus. Even to scanner
> manufacturers, I think, the point is largely irrellevant - so long as
> they can produce a scanner to detect the virus, its level of
> polymorphism is purely academic.

Of course, it is academic issue... Actually, such an evaluation
criteria would be more useful to the anti-virus researchers than to
the end user... But it wouldn't be completely useless even to the end
user. The ability to detect extremely polymorphic viruses reflects the
quality of the R&D department of the company that produces a scanner.
The users might want to know "how good" that company is in detecting
"difficult" viruses. For that purpose, there needs to be a way to
measure the "difficultness" (i.e., the polymorphism) of the virus
objectively. Why do you think users keep asking whether some scanner
detects MtE, instead of asking whether it detects Cascade...
Regardless that Cascade is rather common and none of the MtE-based
viruses has been found in the wild yet...

> Even so, taking it that there can be no a-priori measure of
> polymorphism, for specific purposes, measures can be defined that,
> while not measuring randomness, give something that is useful in the
> context.

Yes, it would be useful if we can achieve at least that...

> 1 Is every byte of every sample constant? (a simple CRC will identify it)
> 2 Is there a fixed (no wildcards) signature that will identify it?
> 3 Is there a simple wildcard signature (constant length) to identify it?
> 4 Is there a complex wildcard signature to identify it? ( signature matches
> variable length strings)
> 5 etc

Right, this is something like the "classes" scheme described in my
original message... However, the real problem is how to differentiate
the polymorphism of the viruses that are in category "5 etc"... :-)

> in terms of scanning. Still, it's really only of use at low levels of
> polymorphism - after that things would start to get really hairy . . .

Exactly...

> fascinating stuff. One metric that I think might be interesting would
> extract the total number of useful signatures from a program (or as a
> ratio of the total possible signatures for that file) - not only would
> you get some idea of polymorphism, but you'd also get some idea of how
> well a signature picked at random for the virus would withstand random
> modifications to the virus. This could give stats for how likely a
> signature would be of detecting various new variants with increasing
> modifications. Because it's signature-based, the effect of moving
> sections of code around from original to variant is much less over

Hmm, that sounds interesting... Could you write some program that
implements this idea? Would be nice to test it in practice...

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:[phone], Fax: [phone]      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: [e-mail]    D-2000 Hamburg 54, Germany