2026-03-13T08:23:58Z https://iwate-u.repo.nii.ac.jp/oai

oai:iwate-u.repo.nii.ac.jp:00009891 2023-05-16T11:53:38Z 1515:1519

An Automatic Unpacking Method for Computer Virus Effective in the Virus Filter Based on Paul Graham's Bayesian Theorem ZHANG, Dengfeng NAKAYA, Naoshi KOUI, Yuuji YOSHIDA, Hitoaki 社団法人　電子情報通信学会 Copyright (c) 2009 （社）電子情報通信学会 virus obfuscate compression unpacking Bayesian virus filter Recently, the appearance frequency of computer virus variants has increased. Updates to virus information using the normal pattern matching method are increasingly unable to keep up with the speed at which viruses occur, since it takes time to extract the characteristic patterns for each virus. Therefore, a rapid, automatic virus detection algorithm using static code analysis is necessary. However, recent computer viruses are almost always compressed and obfuscated. It is difficult to determine the characteristics of the binary code from the obfuscated computer viruses. Therefore, this paper proposes a method that unpacks compressed computer viruses automatically independent of the compression format. The proposed method unpacks the common compression formats accurately 80% of the time, while unknown compression formats can also be unpacked. The proposed method is effective against unknown viruses by combining it with the existing known virus detection system like Paul Graham's Bayesian Virus Filter etc. The Institute of Electronics, Information and Communication Engineers 2009-01-01 journal article VoR https://iwate-u.repo.nii.ac.jp/records/9891 10.1587/transcom.E92.B.1119 0916-8516 IEICE Transactions on Communications E92-B 4 1119 1127 https://iwate-u.repo.nii.ac.jp/record/9891/files/ieicetc-ve92-bn4p1119-1127.pdf application/pdf 4.7 MB 2016-11-14