`
`VIRUS BUUET/N CONFERENCE, SEPTEMBER 1995 • 75
`
`
`
`
`
`
`
`
`
`DYNAMIC DETECTION AND CLASSIFICATION OF
`
`COMPUTER VIRUSES USING GENERAL BEHAVIOUR
`
`PATTERNS
`
`Morton Swimmer
`
`Virus Test Center, University of Hamburg, Odenwaldstr. 9, 20255 Hamburg, Germany
`
`
`
`
`
`
`
`Email swimmer@acm.org Tel +49 404 91004{ · Fax +49 405 471 5226 ·
`
`
`
`Baudouin Le Chartier and Abdelaziz Mounji
`
`
`
`
`
`F.U.N.D.P., Institutd'Informatique, University ofNamur, Belgium
`
`
`
`
`Email ble@info.fundp.ac.be/ amo@info.fundp.ac.be
`
`ABSTRACT
`
`The number of files which need processing by virus labs is growing exponentially. Even though only a small
`
`
`
`
`
`
`
`
`
`
`
`
`
`proportion of these files will contain a new viros, eachjile requires examination. The normal method for
`
`
`
`
`
`
`
`
`dealing with.files is still broteforce manual analysis. A virus expe11 mns several tests on a given file and
`
`
`
`
`
`
`
`delivers a verdict on whether it is virulent or not. !fit is a new virus, it will be necessa,y to detect it. Some
`
`
`
`
`
`
`too Is have been developed to speed up this process, rangingfrom programs which identify previously
`
`
`
`
`
`
`classified files to programs that generate detection data. Some antis virus products have built-in mechanisms
`
`
`
`
`
`
`based on heuristics, which enable them to detect unknown viruses. Unfortunately all these tools have
`limitations.
`
`of a virtual PC. the system activity how an emulator is used to monitor In this paper, we will demonstrate
`
`
`
`
`
`
`
`
`
`and how the expert system ASAX is used to analyse the stream of data whicg the emulator produces. We use
`
`
`
`
`
`
`
`general rules to detect real vin1ses generically and reliably, and specific rules to extract details of their
`
`
`
`
`
`
`
`behaviour. The resulting system is called VIDES: it is a prototype for an automatic ana (J1sis system for
`
`
`
`
`
`
`
`computer viruses and possibly a prototype anti-virus product for the emerging 32 bit PC operating
`systems.
`
`1 INTRODUCTION
`
`is not so files each month, but the problem of suspected Virus researchers must cope with many thousands
`
`
`
`
`
`
`
`
`
`
`
`
`much the number ofnew viruses (which number perhaps a few hundred and grows at a nearly exponential
`
`
`
`
`
`
`as the number of files the researcher receives and must analyse - the glut. Out of perhaps one hundred
`rate)
`
`
`
`
`files, only one may actually contain a new virus. Unfortunately; there are no shortcµts. Every file has to be
`processed.
`
`B.ulletin Ltd,21 The Quadrant, Abingdon, Oxfordshire, OX143YS, England.
`
`
`
`VIRUS BVLLET!NCONFERENCE©1995Virus
`
`
`
`
`
`
`
`Tel. +44 (0)1235 555139. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form
`
`
`without the prior written pennission of the publishers.
`
`CS-1013
`Cisco Systems, Inc. v. Finjan, Inc.
`
`
`
`76 • SWIMMER: DYNAMIC DETECTION
`
`
`AND CLASSIFICATION OF COMPUTER VIRUSES ...
`
`
`
`
`
`The standard method of sorting out such files is still brute force manual analysis, requiring specialists.
`
`
`
`
`
`
`
`
`
`
`
`
`Some tools have been developed to help cope with the problem, ranging from programs
`
`which identify and
`
`
`
`
`
`
`
`
`remove previously-classified files and viruses to utilities which extract strings from infected files that aid in
`
`
`
`
`
`
`
`identifying the viruses. However, none of the solutions are satisfactory. Clearly, more advanced tools are
`needed.
`
`is discussed. analysis a s applied to viruses In this paper, the concept of dynamic This is based on an idea
`
`
`
`
`
`
`
`
`
`
`
`
`
`called VIDES (Vines Intrusion Detection Expert System), coined at the Virus Test Center [BFHS9 l]. The
`
`be capable of detecting
`
`
`
`
`
`
`system will comprise of a PC emulation and an IDES-like expert system. It should
`
`rules, as shown in the preliminary work done wit11 Dr.
`Fischer
`
`behaviour using a set of a priori
`viral
`
`
`
`advanced rules will help i n classifying the detected virus.
`
`Hiibner. Furthermore,
`
`The present version of VIDES is only ofinterest to virus researchers; it is not designed to be a practical
`
`
`
`
`
`g power and hardware for the end-user -its demands on processin
`
`
`
`platfonn are too high. However, it
`system
`
`ation information to the
`
`
`
`
`
`
`can be used to identify unknown viruses rapidly and provide detection and classific
`detection technology in
`
`
`
`researcher. It also serves as a prototype for the future application ofintrilsion
`
`operating systems, such as OS/2, MS-Windows NT and 95,
`
`
`detecting malicious software under future
`
`
`Linux, Solaris, etc.
`
`(
`The rest of the paper is organized as follows: Section 2 presents the current state of the art in anti-virus
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`technology; Section 3 describes a generic virus detection rule; Section 4 discusses the architecture of the PC
`
`
`
`
`
`
`
`auditing system; Section 5 shows how the expert system ASAX is used to analyse the activity data collected
`
`
`
`
`by the PC emulator; and fmally, Section 6 contains some concluding remarks.
`
`
`
`2 CURRENT STATE OF THE ART
`
`
`
`virus. to define the tenn computer For the purpose of discussion it will be necessary
`
`
`
`
`
`
`
`2.1 TERMS
`
`definition for a computer virus. What is missing is a descripti
`
`
`
`There is still no universally-agreed
`
`on which
`
`
`
`
`
`
`
`
`
`
`is still general enough to account for all possible implementations of computer viruses. An attempt was
`
`
`
`
`
`made in [Swi95], which is the result of many years of experience with viruses in the Virus Test Center. The
`
`
`
`
`
`
`
`
`
`following definition for a computer virus is the result of discussion in comp. virus (Virus-L) derived from
`[Seb]:
`
`or a program that can 'infect' Def 1 A Computer Virus is a routine
`
`other programs by modifying them
`
`
`
`
`
`
`
`
`
`
`
`evolved, program implies or their environment such that a call to an infected a call to a possibly
`
`
`fanctional�y similar, copy of the virus.
`
`
`
`
`
`
`A more formal, but less useful, definition of a computer virus can be found in [ Coh85]. Using the form al
`
`
`
`definition, itwas possible to prove the virus property undecidable.
`
`We talk of the infected file as the hotu program. System viruses infect system programs, such as the boot
`
`
`
`
`
`files such as EXE or COM files. For an in
`
`
`
`
`or Master Boot Sector, whereas file viruses infect executable
`
`
`
`
`
`
`such as: [Hru92], please refer to literature depth discussion of the properties of viruses, [SK94], [Coh94] or
`[Fer92].
`
`and the generic
`Today, anti-virus technology can be divided into two approaches: the vines spec(fic
`
`
`
`
`
`
`before they can be detected. Due to
`
`
`
`
`approach. In principle, the fonner requires knowledge of the viruses
`
`
`
`
`
`advances in technology, this prerequisite is no longer entirely valid in many of the modem anti-virus
`to detect a virus by
`
`
`
`
`products. This type of technology is known to us as a scanner. The latter attempts
`
`
`
`
`
`ristic of all viruses. For instance, integrity checkers detect
`viruses by checking
`
`attributes characte
`observing
`
`
`
`
`for modifications in executable files; a characteristic of many (although not all) viruses.
`
`v7RUS BULLET!NCONFERENCE©1995 Virus Bulletin Ltd,21 TheQlllldrant, Abingdon, Oxfordshire, OX143YS, England.
`
`
`
`
`
`
`
`
`system, or transmittmay be reproduced, stored in a retrieval
`
`
`
`
`Tel. +44 (0)1235 555139. No part ofthis publication
`ed in any fomi
`
`
`
`without the prior ,vrinen pcnnission of the publishers.
`
`
`
`
`
`VIRUS BUUETIN CONFERENCE, SEPTEMBER / 995 • 77
`
`
`
`2.2 VIRUS SPECIFIC DETECTION
`
`Virus specific detection is by far the most popular type of virus protection used _on PCs. 1nfonnation
`
`
`
`
`
`
`
`
`
`
`
`from the virus analysis is used in the so-called scanner to detect it Usually, a scanneruses a database of
`
`
`
`
`
`
`virus identification information which enable it to detect all viruses previously analysed.
`
`i.e. incorrect terminology; The term scanner has become increasingly The term comes from lexical scanner,
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`a pattern matching tool. Traditionally scanners have been just that. The information extracted from viruses
`
`
`
`were strings which were representative of that particular virus. This means that the string has to:
`
`• differ significantly from all other viruses, and
`
`
`
`
`
`
`
`
`
`..anti-virus programs • differ significantly from strings found in bona.fide
`
`
`
`
`
`
`
`
`
`
`
`such strings was the entire.art of anti-virus program writing until polymorphic viruses appeared on
`
`
`
`
`
`Finding
`the scene.
`
`s.earching methods. The body or the virus was
`
`
`
`
`
`
`Encrypted viruses were the first minor challenge to string
`
`
`
`
`
`encrypted in the host file, and could not be sought, due to its variable nature. However, the body was
`
`
`
`prepertded by a decryptor-Joader which must be in plain text ( unencrypted code); otherwise it would not be
`
`
`
`
`
`
`
`executable. This decryptorcan still be detected using strings, even ifitbecomes difficult to differentiate
`
`between viruses.
`
`Polymorphic viruses are the obvious next step irt avoiding detection. Here,the decryptot' is implemented
`
`
`
`
`
`
`
`
`
`
`
`
`in a variable manner; so thatpattemmatchingbecomes impossible orvery difficult Early polymorphic
`
`
`
`
`
`viruse� �ere identified using a set of patterns (sn-ings with variable elements).Moreover, simple virus
`
`
`
`
`detection techniques are made unrdiable by the appearance of the so-called
`such as
`
`Mutatlon Engines
`
`
`
`
`
`
`
`MtE and TPE (Trident Polymorphic Engine). These are object library modules generating variable
`
`
`
`
`
`
`
`highly implementations of the virus decryptor. They can easily be linked with viruses to produce
`
`
`
`
`
`
`polymorphic infectors. Scanning techniques are further complicated by the fact that the resulting viruses
`
`
`
`
`do not have any scan strings in common even if their structure remains constant. When polymorphic
`
`
`
`
`improved, statistical analysis of the opcodes was used.
`technology
`
`Recently, the best of the scanners have shifted course frbm merely detecting viruses to attempting to
`
`
`
`
`
`
`
`
`
`
`
`
`identify the virus. This is often done with added strings, perhaps position dependent, or checksums, over the
`
`
`
`
`
`
`
`invariant part of the virus. To support this, many anti-virus products have implemented machine-code
`
`
`
`
`
`
`emulators so that the virus' own decryptor can be used to decrypt the virus. Using these enhancements, the.
`
`
`
`
`positive identification of even polymorphic viruses poses no problem.
`
`The next shift many scanners are presently experiencing is away from known virus only detection to
`
`
`
`
`
`
`
`
`
`
`
`
`Heuristics are built into an anti-virus detection of unknown viruses. The method of choice is. heuristics.
`
`
`
`
`
`
`product in an attempt to deduce whether a file is infected or not. This is most often done by looking for a
`
`
`
`
`
`pattern of certain code fragments that occur most often in viruses and hopefully not in bona fide programs.
`
`Heuristics analysis suffers from a moderate to high false-positive rate. Of course, a manufacturer of a
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`heuristic, scanner will improve the heuristics both to avoid false positives and still find all new viruses, but
`
`
`
`
`
`
`
`
`both cannot be achieved completely. Usually, a heuristic scanner will contain a 'traditional' pattern-matching
`
`
`
`component, so that viruses can be identified by rtame.
`
`
`
`2.3 GENERIC VIRUS DETECTION
`
`
`
`Computer viruses must replicate to be viruses. This means that a virus must be observable by its mechanism
`
`
`
`
`
`
`ofreplication.
`
`VU11SBulletin Ltd,21 The Quadrant, Abingdon, Oxfordshire, OX14JYS, Engl11J1d.
`
`
`
`
`
`VIRUS BVLLETINCONFERENCE©l995
`
`
`
`
`
`
`system, or transmitted No part of this publicatioh may be reproduced, stored in a retrieval ih any form
`
`Tel. +44 (0)1235 555139.
`
`without the prior written pennission of the publishers.
`
`
`
`
`
`
`
`... VIRUSES AND CLASSIFICATION 78 • SWIMMER: DYNAMIC DETECTION OF COMPUTER
`
`
`
`
`
`
`
`UnfortW1ately, it is not as easy to observe the replication as it may seem. DOS, in it various flavours,
`
`
`
`
`
`
`
`
`
`
`
`provides no process isolation, or even protection of the operating system from programs. This means that
`
`
`
`
`
`any monitoring program can be circumvented by a virus which has been programmed to do so. There used to
`
`
`
`
`
`be many anti-virus programs which would try to monitor system activity for viruses, but were not proof
`
`
`
`
`
`
`against all viruses. This problem Jed to the demise of many such programs. Later in the paper, we shall
`
`
`
`
`discuss how we avoided the problem when implementing VIDES.
`
`A more common approach isto detect symptoms of the infection such a:s file modifications, This typ.e of
`
`
`
`
`
`
`
`
`
`
`program is usually called an integrity checker or checksummer;
`
`When programs are installed on the PC, checksums are calculated over the entire file, or over portions
`
`
`of the
`
`
`
`
`
`
`
`file. These checksums are then used to verify that the programs have not been modified. The shortcoming of
`
`
`
`
`
`
`
`determine whether in the file, but cannot a modification checker can detect this method is that the integrity
`
`
`
`
`the modification is due to a virus or not. A legitimate modification to, for instance, the data area of a
`
`program will cause the same alarm as a virus infection.
`
`Another problem is virus technology aimed specifically against anti-virus products. Advances in stealth and
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`tunnelling technology have made updates necessary. There have also been direct attacks against
`
`
`
`
`
`
`particular integrity checkers, rendering them useless. Again, the lack of support from the operating
`
`
`
`
`
`
`system makes the prevention of such attacks very difficult. As a consequence, the acceptance of such
`
`products is low.
`
`The non-specific nature of the detection has little appeal for many of the users. Even generic repair
`
`
`
`
`
`
`
`
`
`
`
`
`facilities in the anti-virus products do not help, despite these methods effectively rendering identification
`unnecessary.
`
`
`
`
`
`The problem is partly understandable. The user is concerned with his data. Merely
`
`
`
`
`disinfecting the programs is not enough if data has been manipulated. Only if the virus ha:s been
`
`
`
`identified and analyzed can the user determine if his data was threatened.
`
`Generic virus detection technology should not be dismissed. It is just as valid as virus-specific technology.
`
`
`
`
`
`
`
`
`
`
`
`
`
`The problems so far have stemmed from the permissiveness of the underlying operating system, DOS, and
`
`
`
`from the limits in the programs. Both problems can be addressed.
`
`
`3 DYNAMIC DETECTION RULES
`Before we can attempt to detecta virus using ASAX, we need to model the virus attack strategy. This is
`
`
`
`
`
`
`
`
`
`
`
`then translated into RUSSEL, the rule-based language which ASAX uses to identify the virus attack.
`
`
`
`
`
`3.1 REPRESENTING INFECTION PATTERNS USING STATE TRANSITION DIAGRAMS
`
`State transition diagrams are eminently suitable for representing virus infection scenarios.In
`
`
`this model of
`
`
`
`s some
`
`
`
`
`
`
`representation, we distinguish two basic components: a node in a state transition diagram represent
`
`
`
`
`
`
`
`
`aspects of the computing system state. Arcs represents actions performed by a program in execution.
`as shown in Figure
`
`
`
`Given a (current) states;, the action a takes the system from the states; to the state
`
`
`
`
`
`
`
`
`1.The infection process played by a virus can be viewed as a sequence of actions which drives the system
`
`
`
`
`
`
`In order to get a completestate, where some files are infected. from an initial clean state to a final infectious
`
`the objects as
`
`
`
`
`characterizing description of the actual scenario, a state is adorned by a set of assertions,
`
`affected by actions.
`
`s1
`
`a
`
`
`
`.Figure 1: State transition diagram
`
`
`
`
`
`Oxfordshire,OX143YS, England. VIRUS BULLETIN C0NFERENCE©1995 Virus Bulletin Ltd, 21 The Quadrant, Abingdon,
`
`
`
`Tel. +44 (0)1235 555139.
`
`
`
`
`
`
`No part of this publication may be reproduced, stored in a retrieval system, or transmitted In any fonn
`
`
`without the prior written permission of the publishers.
`
`
`
`VIRUS BUUETIN CONFERE.NCE, SEPTEMBER 1995 • 79
`
`In practice, we only represent those actions relevant to the infection scenario, As a result, many possible
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`actions may occur between adjacent states, but are not recorded because they do not entail a modification in
`
`
`
`
`
`
`
`the current state. In terms of auditing, irrelevant audit records may be present in the sequence of audit
`
`
`
`records representing the infection signature.
`
`
`
`For the sake of simplicity, discussion of the generic detection rules are based on the state transition
`
`
`
`
`
`
`
`
`diagrams described above.
`
`3.2 BUILDING THE RULES
`
`other rules. As its
`
`VIDES uses three types of detection rules:
`generic detection rules, virus specific rules,
`
`
`
`
`
`
`
`
`
`
`
`
`name implies, generic rules are used to detect all viruses which use a known attack pattern. For this, models
`
`
`
`
`
`
`of virus behaviour are needed for the target system (in our case MS-DOS). Virus-specific rules use
`
`
`
`
`
`
`
`
`information from a previous analysis to detect that specific virus, or direct variants. These rules are similar
`
`
`
`
`to virus-specific detection programs, except for the fact that they analyze the dynamic behaviour of the virus
`
`
`
`
`
`
`from the virus which other information rules' for gleaning instead of its code. Finally, there are the 'other
`
`can be used in its classification.
`
`
`
`
`
`
`We will not go into the virus-specific rules or the 'other' rules, concentrating instead on the generic rules.
`
`
`
`
`
`In developing a generic rule for detecting viruses, we need to have a model for the virus attack. No one
`
`
`
`
`
`
`
`
`
`
`model will do, because MS-DOS viruses can use choose from many effective strategies. This is
`
`
`
`
`
`
`compounded by the diversity ofexecutable file types for MS-DOS. Fortunately forus,themajority of
`
`
`
`
`
`viruses have chosen one particular strategy, and infect only two types of executable files. This means that
`
`
`
`
`we can detect most viruses with very few rules. On the other hand, a vinis which uses an unknown attack
`
`
`
`
`
`
`
`
`strategy will not be detected. For this reason, the prototype analysis system contains an auxiliary static
`
`
`
`analysis component to detect such prob !ems.
`In the following, we will develop a generic rule which detects file infectors that modify the file directly to
`
`
`
`
`
`
`
`
`
`
`
`gain control over that file. We will concentrate on COM file infectors. EXE file infectors are detected in an
`
`analogous way.
`
`
`
`
`
`We must make two assumptions about the behaviour of DOS.viruses to help us build the rule.
`
`
`
`over the virus modifies the host file in such a way that it gains control Assumption 1: Afile·infecting
`
`
`
`
`
`host file when the host file is run.
`
`
`
`This is a specific version of the virus definition (Def 1). However, it doesn't specify when the virus gains
`
`
`
`
`
`
`
`
`
`
`
`
`control over the host file.
`
`
`
`host the original over the file before file receives control Assumption 2: The virus in an infected
`
`
`
`
`
`
`
`
`
`program.
`
`
`
`That is, when the infected file is run, the virus is run before the host program.
`
`
`
`Discussion: If the virus never gains control over the host file, it would not fulfil the definition of a virus.
`
`
`
`
`
`
`
`
`
`This observation leads to Assumption 1. However, there is no reason (in the definition) why the virus must
`
`gain control before the host does.
`
`We make an additional assumption that the virus does gain control before the host program does. The reason
`
`
`
`
`
`
`
`
`
`we do this is to avoid very blatant false positives. However, it should be noted that Assumption 2 does not
`
`
`
`
`
`
`
`
`
`
`result from the virus definition, and willcause some viruses to be missed. For these cases, other rules are
`used.
`
`VIRUS BULLETINCONFERENCE©l995VlrusBulletinLtd, 21 The Quadrant, Abingdon, Oxfordshire., OX143YS, England.
`
`
`
`
`
`
`
`
`
`
`
`
`system, or transmitted stored TeL +44 (0)1235 555139. No part of this publication may be reproduced, in. a retrieval. in any fonn
`
`
`without the prior written permission publishers. of the
`
`
`
`
`
`
`
`
`
`
`
`.. : OF COMPUTER VIRUSES 80 • SWIMMER: DYNAMIC DETECTION AND CIASS/FICATION
`
`3.3 FINDING COM FILE INFECTIONS
`
`
`
`
`
`
`
`
`
`
`
`With respect to assumptions l and 2, we are looking for two possible infection strategies:
`
`other
`read or writes
`
`,_
`
`write BOF
`
`other I
`
`read or writes !
`
`
`
`
`
`Figure 2: Generic rule for identifying COM file infectors
`
`of the file (BOF), to the beginning for a write Therefore, we are looking 1 The virus is overwriting.
`
`
`
`
`
`
`
`
`
`
`without a previous read to the same location. Other reads and writes are permitted.
`
`
`
`
`in 2 The virus is non-overvvriting. We expect to see a read to BOF, then a write to BOF. Before,
`
`
`
`between, and after these two events, other reads and writes are pennitted.
`
`
`
`The assumption in both cases is that the write to BOF causes the virus to gain control on execution.
`
`
`
`In the case of a non-overwriting virus,we assume that the virus first reads the original code at BOF and
`
`
`
`
`
`
`
`
`
`then replaces it with its own code, usually a jump to the virus body. In most cases, the number of bytes read
`
`
`
`
`will be the same as the number of bytes written, but we cannot assume this. In the case of an overwriting
`
`
`virus, the code is not read ( and saved somewhere), but overwritten.
`
`
`
`Other reads and writes are not actually relevant to the detection of the virus. They can be logged and used in
`
`
`
`
`
`
`
`
`
`generating virus-specific rules.
`
`The rule is initiated by the opening of a file (in this case a COM file). The rule is terminated by a close of
`
`
`
`
`
`
`
`we expect the the file, where this does not have to be done by the virus itself In between these two events,
`
`
`
`
`
`BOFwithout actual infection to occur. We look for the read BOF followed by the write BOF or the write
`
`the read. Other administrative
`
`
`
`
`operations, like tracking the file position, are also done by the rule. This is
`
`
`
`shown in the state transition diagram ofFigure 2.
`
`Some viruses cause problems for the rule by closing the file after a first set of operations. This is handled
`
`
`
`
`
`
`
`
`In order that open event on the same file from the virus. by a reopen mechanism which waits for a possible
`
`
`
`
`this rule does not stay active indefinitely and clog up the rule memoiy, there are a number of terminating
`
`England.
`The Quadrant, Abingdon, Oxfordshire, OX143YS,
`
`
`Virus Bulletin Ltd,21
`VIRUS BULLETINCONFERENCE©1995
`
`
`
`
`
`
`
`
`Tel. +44 (0)1235 555139. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any fonn
`
`
`
`without the prior written permission of the publishers.
`
`
`
`
`
`VIRUS BULJ.£.T/N CONFERENCE, SEPTEMBER I 995 • 81
`
`
`
`is asa separate its implementation whereas as a transitioh element, is abstracted events. In fig. 2, reopen
`
`
`
`
`
`
`
`
`
`
`rule.
`
`MS-DOS provides two methods of accessing files. The most common method uses file handles. Access
`
`
`
`
`
`
`
`
`
`
`using.file control blocks (PCB) was provided for compatibility to CP/M, and is rarely used, even by
`
`
`
`
`
`
`
`
`
`viruses. However, because it is used, we need a separate rule to handle this method. The basic rule stays the
`
`
`same, but internal handling of the data is different.
`
`We could avoid this problem by abstracting the audit data to give us a generic view of the system events.
`
`
`
`
`
`
`
`
`
`
`This way, we could reduce the number of audit records to only relevant higher-level records by using a
`
`
`
`
`
`
`
`
`filter. Afte:r that, processing becomes simpler as the problems ofreopens and handle/PCB use disappear.
`
`
`
`
`
`
`This method also. allows us to apply the rules on non.:MS-DOS systems which provide similar file handling:
`
`As a matter of fact, ASAX itseffis the logical choice to act as the filter. The firstASAXsystem reads the
`
`
`
`
`
`
`
`
`
`
`
`raw audittrail, converts it into generic data, and pipes its oulput as a NADF file for further processing (see
`
`
`
`
`
`
`
`Section 5). Using ASAX as a filter allows us to reduce the complexity of maintaining such a system while
`
`not sacrificing any power.
`
`(
`
`4 PC AUDITING
`
`The prerequisite for using an Intrusion Detection (ID) system like ASAX is an audit system which securely
`
`
`
`
`
`
`
`
`
`
`
`
`collects system activity data. In addition, integrity of the ID system it')elfmustnot be compromised: this
`
`
`
`
`
`
`
`means thatthe audit data retrieval, analysis and archiving must be secured against corruption by viruses.
`
`
`
`
`
`
`
`Moreover, the ID systemmust not be prevented from reporting (raising alarms, updating virus information
`
`
`
`
`
`
`databases) the results of such analysis. DOS neither provides such a service, nor makes the implementation
`
`
`
`
`
`
`of data can be mechanisms means that the collection lack of security of such a service easy. Its total
`
`
`
`
`
`
`subverted. Even if the collection can be secured, the data is open to manipulation if stored on the same
`machine.
`
`Forthe prototype ofVID ES, we were not bound to a real world implementation, so we explored various
`
`
`
`
`
`
`
`
`
`
`
`alternative possibilities. The experience gained by the use of such a system will not benefit DOS users, but
`
`
`
`
`
`
`
`should be applicable to users of various emerging 32-bit operating systems which offer DOS support.
`
`
`
`We have made several attempts to build a satisfactory audit system: these are described hereafter.
`
`
`
`
`
`
`
`
`
`4.1 DOS INTERRUPTS
`as indexed which can be described via interrupts, programs All DOS services are provided to application
`
`
`
`
`
`
`
`
`
`
`
`
`
`inter-segment calls. Primarily, interrupt Ox2 l is used. The requested service is entered into the AH
`
`
`
`
`
`
`register and its parameters are entered into the other registers. When the service is finished, it returns
`
`
`
`
`
`
`control to the calling program and provides its results in registers or in buffers.
`
`The ve:ry first implementation of an auditing system was a filter which was placed before DOS Services and
`
`
`
`
`
`
`
`
`
`
`
`
`registered all calls to DOS functions. This was done ve:ry early on, together with Dr. Fischer-Hubner, to
`
`
`
`
`
`prove the feasibility of the VIDES concept. It also demonstrated the limits which DOS imposes on the
`implementation
`
`
`
`
`of such an auditing system: it did not run reliably, and could be subverted by tunnelling
`viruses.
`
`This implementation was soon scrapped,
`
`but it did prove that the premise
`was correct: viruses could be
`
`
`
`
`
`
`found using ID technology. This was perhaps the frrstsuch a trial that had been done [BFHS91].
`
`Virus Bulletin Ltd, 21 The Quadrant, Abingdon, Oxfordshire, OX14 3YS, England.
`
`
`
`
`VIRUS BULLETIN CONFERENCE©1995
`
`
`
`
`
`
`
`Tel. +44 (0)1235 555139. No part of this publicalion may be reproduced, stored in a retrieval syste111, or transmitted in .lllly form
`
`
`without the prior written permission of the publishers.
`
`
`
`
`
`82 SWIMMER: DYNAMIC DETECTION AND CLASSIFICATION OF COMPUTER VIRUSES ...
`
`
`
`
`
`
`
`
`
`•
`
`
`
`4.2 VIRTUAL 8086 MACHINE
`
`The Intel iAPX 386 irttroduced the so-called virtual 8086 machine mode. A protected mode operating system
`
`
`
`
`
`
`
`
`
`
`
`
`
`can create many virtual 8086 m achines in which tasks.can run completely isolated from each other and from
`
`
`
`
`
`
`Operating systems such OS/2 use these only its own environment. the operating system. Each task 'sees'
`
`
`
`
`
`
`constructs to provide a full DOS environment for DOS programs. All calls to the machine (via the BXOS
`
`
`
`
`
`
`
`interface or direct port access) and DOS are redirected to the host operating system ( OS/2 in this case) for
`processirtg.
`
`This mechanism cart also be used to monitor the activity in DOS session. Because all irtterrupts are being
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`redirected to the native operating system, the native operatingsystem can record the activity securely and
`unobtrusively.
`
`Care has to be taken in the implementation of the virtual 8086 machirte. The DOS windows in OS/2 have
`
`
`
`
`
`
`
`
`been shown in tests at the VTC to be too permissive. In the course of a comprehensive test including the
`
`
`
`
`
`
`entire collection of file viruses, many of the viruses running under a DOS window managed to harm vital
`
`
`
`
`
`
`parts ofthe system. One problem was that OS/2 files could be manipulated directly from within the DOS
`
`
`
`
`
`
`session. However, this did notexplain the corruption of the running operating system.
`
`Even though using a virtual 8086 machine was the original method of choice, such experiments showed that
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`the complexity of building a safe implementation would be difficult. A more secure method was sought for
`the prototype.
`
`4.3 HARDWARE SUPPORT
`Hardware· debugging systems, such as the Periscope JV, may be used to monitor system events closely i.rt
`
`
`
`
`
`
`
`
`
`
`
`real time. This is achieved by a card fitted between the CPU and the motherboard and which can set break
`
`
`
`
`
`
`points on various types of events on the PC's bus. The card is connected to a receiving card in a second PC
`
`
`which is used to control the debugging session.
`
`Monitoring system behaviour on a DOS machine can be accomplished by capturing the Interrupt Ox2 I
`
`
`
`
`
`
`
`
`
`
`
`
`
`directly, or by setting a break point irt the resident DOS kernel. Special memory areas can be monitored by
`
`
`
`setting a break condition on access to those areas.
`
`The monitoring is completely unobtrusive, i.e. the program will not notice a difference between running
`
`
`
`
`
`
`
`
`
`with or without the debugger. When an event is triggered, the PC is stopped while the controlling PC is
`
`
`
`
`
`
`processing the data. If the controlling PC is fast enough, the time delay should be nearly negligible.
`
`A hardware solution using the Periscope IV is complicated by the problem of automating the processes
`
`
`
`
`
`
`
`
`
`
`
`
`necessary to test large numbers of viruses on different operating systems. When such a solution is
`
`
`
`
`
`
`
`
`implemented, it will offer the possibility of testing viruses on other PC operating systems which require full
`
`iAPX386 compatibility.
`
`4.4 8086 EMULATION
`The solution which was finallychosen was the software emulation of the 8086 processor. An emulation is a
`
`
`
`
`
`
`
`the binary code as the as irtput, and interprets
`
`
`
`
`program which accepts the entire irtstruction set of a processor
`
`
`
`
`
`
`
`original processor would. All other elements of the machine must be implemented or emulated, e.g. the
`
`
`
`
`
`
`
`various ports. To simplify and quicken the emulation, the BIOS Code (Basic Input Output System-the
`
`
`
`
`
`
`
`interface between the operating system and the hardware) can be replaced with special emulation hooks, so
`
`
`
`
`
`
`
`that the complicated machine access can be skipped as long as all access to those services are routed via the
`
`
`
`
`
`
`BI OS. In the case ofa graphics adapter, the entire hardware must be emulated, whereas disk access can be
`
`handled with hooks in the BIOS.
`
`Quadrant, Abingdon, Oxfordshire, OX143YS, England.
`
`
`VIRUS BULLETINCONFERENCE©199,5 Vil"llll Bulletin Ltd, 21 The
`
`
`
`
`
`
`
`
`
`
`Tel. +44 (0)1235 555139. No part of this publication may be reproduced, stored in a rebieva! system, or transmitted in any foim
`
`
`
`without the prior written pqnuission of the publishers.
`
`
`
`
`
`
`
`VIRUS BUU£TIN CONFERE.NCE, SEPTEMBER I 995 • 83
`
`Using emulation gives us all the advantages of the hardware solution plus the possibility of handling
`
`
`
`
`
`
`
`
`
`
`in pseudo real-time with respect to the program running in the emulation. Because even the
`everything
`
`
`
`
`
`
`
`
`time-giving functions of the emulation are being steered by the emulation, when interruptable to process an
`
`
`event, the time in the emulation can also be stopped.
`
`The emulation is 'safe' as the running vims has no access to the host machine at all. This is because the
`
`
`
`
`
`
`
`
`
`
`
`
`target machine's memory is being controlled entirely by the emulation, and file accesses are directed to a
`
`
`virtual disk, stored as a disk image file.
`
`
`
`The major problem with using an emulation is its lack of speed. Even on fast platforms, the running speed
`
`
`
`
`
`
`is only marginally faster than an original PCIXT.
`
`4.5 ACTIVITY DATA FORMAT
`
`Audit records representing the program behaviour in general, and virus activity in particular, have a pattern
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`which is borrowed from the Dorothy Denning's model ofintrusion Detection [Den87] (<Subject, Action.
`
`
`
`
`
`Object, Exception-Condition, Resource-Usage, Time-Stamp>). However, due to the way processes are
`
`
`
`
`
`
`
`
`
`handled in DOS, this pattern is slightly modified to collect useful available attributes. For instance, the code
`
`
`
`
`
`
`
`segment of a process is chosen instead of the common process identifier in most existing multi-user
`
`operating systems.
`
`The audit record attributes of records as collected by the PC emulator have the following meaning: code
`
`
`
`
`
`
`
`
`
`
`
`
`segment is the address in memory of the executable image of the program;fimction number is the number
`
`
`
`
`
`
`of the DOS function requested by the program; arg ( .. ) is a list of register/memory values used in the
`
`
`
`
`
`call to a·DOS function; ret ( . .) is a list ofregister/memory values as returned by the function call;
`
`
`
`
`Rec Type is the type of the record; StartTime and EndTime are the time stamp of action start and end
`
`
`
`
`
`
`
`respectively. The final format for an MS-DOS audit record is as follows