An anti virus scheme using digital signature and anomaly detection techniques
Among all the computer security breaches, viruses are the most frequent and destructive. Current anti- virus solutions focus too much on virus recognition techniques, causing new viruses to escape detection. Thus, this work proposes an anti-virus scheme that simply defends the data in the computer r...
| Main Author: | |
|---|---|
| Format: | Thesis |
| Language: | English |
| Published: |
2003
|
| Subjects: | |
| Online Access: | http://eprints.utm.my/42601/1/SureshBabuSubramaniamFKE2003.pdf |
| _version_ | 1796858217434710016 |
|---|---|
| author | Subramaniam, Suresh Babu |
| author_facet | Subramaniam, Suresh Babu |
| author_sort | Subramaniam, Suresh Babu |
| collection | ePrints |
| description | Among all the computer security breaches, viruses are the most frequent and destructive. Current anti- virus solutions focus too much on virus recognition techniques, causing new viruses to escape detection. Thus, this work proposes an anti-virus scheme that simply defends the data in the computer regardless of the type and name of virus. The scheme comprises two layers of protection, where the first layer implements digital signature technique while the second layer implements anomaly detection technique. In the scheme, newly downloaded files that have been digitally signed using SHA-l and RSA algorithms are verified at the first layer. Here the source and integrity of the files are determined and the executables with authentic and genuine signatures are accepted and logged into a watch list. At the second layer, the behaviour of the new executables; the ones in the watch list, are monitored closely at the lowest level for any anomalies. These anomalies are either blocked or ignored depending on the configurations set by user. One of the main ideas of the proposed scheme is to focus on new executables alone, as viruses originate only from newly downloaded files, either from email attachments, shared files and folders or new software installation. To realize the proposed scheme a prototype has been developed for Microsoft Windows 98. Meanwhile, to verify the functionality of the prototype, a test program that simulates most of the virus behaviour is also devised. Test results have proven that the proposed scheme can offer users the desired protection against all kinds of malicious programs. |
| first_indexed | 2024-03-05T19:09:10Z |
| format | Thesis |
| id | utm.eprints-42601 |
| institution | Universiti Teknologi Malaysia - ePrints |
| language | English |
| last_indexed | 2024-03-05T19:09:10Z |
| publishDate | 2003 |
| record_format | dspace |
| spelling | utm.eprints-426012017-10-17T14:56:57Z http://eprints.utm.my/42601/ An anti virus scheme using digital signature and anomaly detection techniques Subramaniam, Suresh Babu QA76 Computer software Among all the computer security breaches, viruses are the most frequent and destructive. Current anti- virus solutions focus too much on virus recognition techniques, causing new viruses to escape detection. Thus, this work proposes an anti-virus scheme that simply defends the data in the computer regardless of the type and name of virus. The scheme comprises two layers of protection, where the first layer implements digital signature technique while the second layer implements anomaly detection technique. In the scheme, newly downloaded files that have been digitally signed using SHA-l and RSA algorithms are verified at the first layer. Here the source and integrity of the files are determined and the executables with authentic and genuine signatures are accepted and logged into a watch list. At the second layer, the behaviour of the new executables; the ones in the watch list, are monitored closely at the lowest level for any anomalies. These anomalies are either blocked or ignored depending on the configurations set by user. One of the main ideas of the proposed scheme is to focus on new executables alone, as viruses originate only from newly downloaded files, either from email attachments, shared files and folders or new software installation. To realize the proposed scheme a prototype has been developed for Microsoft Windows 98. Meanwhile, to verify the functionality of the prototype, a test program that simulates most of the virus behaviour is also devised. Test results have proven that the proposed scheme can offer users the desired protection against all kinds of malicious programs. 2003 Thesis NonPeerReviewed application/pdf en http://eprints.utm.my/42601/1/SureshBabuSubramaniamFKE2003.pdf Subramaniam, Suresh Babu (2003) An anti virus scheme using digital signature and anomaly detection techniques. Masters thesis, Universiti Teknologi Malaysia, Faculty of Electrical Engineering. http://libraryopac.utm.my/client/en_AU/main/search/detailnonmodal/ent:$002f$002fSD_ILS$002f0$002fSD_ILS:360506/one?qu=An+anti+virus+scheme+using+digital+signature+and+anomaly+detection+techniques |
| spellingShingle | QA76 Computer software Subramaniam, Suresh Babu An anti virus scheme using digital signature and anomaly detection techniques |
| title | An anti virus scheme using digital signature and anomaly detection techniques |
| title_full | An anti virus scheme using digital signature and anomaly detection techniques |
| title_fullStr | An anti virus scheme using digital signature and anomaly detection techniques |
| title_full_unstemmed | An anti virus scheme using digital signature and anomaly detection techniques |
| title_short | An anti virus scheme using digital signature and anomaly detection techniques |
| title_sort | anti virus scheme using digital signature and anomaly detection techniques |
| topic | QA76 Computer software |
| url | http://eprints.utm.my/42601/1/SureshBabuSubramaniamFKE2003.pdf |
| work_keys_str_mv | AT subramaniamsureshbabu anantivirusschemeusingdigitalsignatureandanomalydetectiontechniques AT subramaniamsureshbabu antivirusschemeusingdigitalsignatureandanomalydetectiontechniques |