Handbook of Information Security: Threats, Vulnerabilities, Prevention, Detection, and Management, Volume 3

Antivirus Technology

Matthew Schmid, Cigital, Inc.

Introduction

Antivirus Goals

Antivirus Technologies and Techniques

Signature Scanning

Heuristic Virus Detection

Integrity Checking and Code Signing

Scanning on Demand

Virus Removal and Recovery

Antivirus Policies and Practices

Deploying Antivirus Solutions

Awareness

Enforceable Security Policies

Updates and Operating Systems

Summary

Glossary

Cross References

References

INTRODUCTION

This chapter addresses the technologies and techniques being used in the fight against malicious software. The roots of this battle can be found in software designed to detect and eliminate computer viruses, though as this chapter illustrates, this 1.5 billion dollar industry has progressed far beyond the simple scanning techniques often associated with antivirus products (Gartner, 2002). A constant game of cat-and-mouse between the antivirus industry and malicious software authors has resulted in comprehensive tools designed to protect users from harm and equally sophisticated malicious software that attempts to evade detection and spread voraciously throughout the Internet.

Throughout this chapter the term antivirus refers to anything designed to combat a variety of malicious threats, including computer viruses, worms, Trojan horses, spyware, and other digital pests. Detailed information on various types of malicious software can be found elsewhere in this Handbook, and the distinctions will be largely ignored in this chapter except when necessary ...