资源描述：
《Heuristic Engines_启发式引擎.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。
1、VIRUSBULLETINCONFERENCE,SEPTEMBER2001•123HEURISTICENGINESFranciscoFernandezFullcompanyaddressTel+•Fax+•EmailABSTRACTTheprincipaldrawbackwithconventionalscannersisthattheycanonlydetectknownviruses.That’swhyanti-virussoftwaredevelopershavebeenemployingheuristicenginesforsomet
2、ime,thusincreasingthepossibilityofdetectingunknownviruses.Heuristicanalysisisapowerfultechniqueanditcanbeparticularlyusefulinconjunctionwithconventionalscanningtechniques,buthassomedrawbackssuchastimeandmemorylimitation.Theproblemismagnifiedifwetakeintoaccounttherecentappea
3、ranceofscriptviruses,whichproveproblematicforanti-viruscompanies.Scriptvirusescanappeareverywhere:htmlpages,emailmessages,documentfiles,etc…Newwindowsvi-ruses(suchasTUAREG)willalsoappearanddisconcertemulatorsandheuristicengines.Forthesereasons,thereisanurgentneedtoupdateheu
4、risticenginesifwearetobepreparedfornewthreats.Inthisarticle,wewillexamineseveralheuristictechniquesanddiscusstheirefficiencyandflaws.Wewillpayparticularattentiontoscriptviruses.VIRUSBULLETINCONFERENCE©2001VirusBulletinLtd,ThePentagon,Abingdon,Oxfordshire,OX143YP,England.Tel
5、+441235555139.Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmittedinanyform,withoutthepriorwrittenpermissionofthepublishers.124•FERNANDEZ,HEURISTICENGINES1.INTRODUCTIONPriortocoveringheuristicengines,wearegoingtodescribeconventionalscanners,explaini
6、nghowtheyworkandtheiradvantagesanddisadvantages,asajustificationfortheneedforheuris-tics.DetectionTechniquesThemostdirectapproachistoattempttodetecttheexistenceofvirusesbeforetheyactivate.Therearetwowaystodothis:•Signaturerecognition•HeuristicanalysisHowever,withvirusesbein
7、gwhattheyare,thedirectapproachisnotalwaysthemosteffective.Theindirectapproachinvolvestwofurthermethods:•Behaviourblocking•IntegritycheckingLet’stakealookateachofthesemethods.SignatureRecognitionAscannerreadsthecontentsofexecutablefiles,lookingforviruscodeandnotifyingtheuser
8、whenanyisfound.Asignaturedatabaseisattheheartofallvirusscanners.Thisisacollectiono
