Richard Ford Florida Institute of Technology
Matt Wagner Microsoft Corporation
Jason Michalske Florida Institute of Technology
The need for reliable detection of rapidly spreading worms has never been higher; viruses like SQL/Slammer have proven that an epidemic can occur far faster than we can react using existing technology. Thus, there has been significant interest in developing fast and reliable techniques for detecting previously unseen malicious code.
In this paper, we extend the work carried out under the Gatekeeper project, a behavioural virus detection engine with undo capability. New techniques to provide for higher virus detection rates with lower false positive rates are described for the first time, and a demonstration of the new Gatekeeper tool is given, showing detection rates that are extremely high with low processor overhead and minimal false positives. Directed attacks against Gatekeeper are considered, and novel defences described.
