#the microdot

[kangpw-blog]

Unknown virus precautionary technology of the mainstream

The unknown virus takes precautions against the technical main mentality of designing is: Since the anti-virus engineer can judge whether a procedure is the virus accurately through behavior of the analysis program, could the the intersection of analysis and judgement and process automation, routinization then? The fact proves, this can be realized. Through analyzing, summing up, summarizing about the behavioral law of virus, and combine the experience that the anti-virus expert judges the virus, refine into virus and discern the regular knowledge base. Imitate the mechanism that the expert finds the new virus, through the numerous probes distributed in operating system, monitor the run program dynamically, transfer various movements of API, analyze a series of movements of the procedure that makes up the significant behavior through the logical relationship, and then the virus of integrated application discerns regular knowledge, realize that judges the virus automatically.

Xu Liu think unknown virus take precautions against technical key thinking, by with artificial anti-virus Expert System to defend the software while being initiative, the automatic analysis program behavior on user's computer, discern independently, quote and combine virus of automatic erase clearly. This is technical " Gold three rules " Including: First, can discern the unknown virus independently; Second, can quote the unknown virus clearly; Third, to unknown virus can automatic erase.

The unknown virus takes precautions against the technology system must regard possessing the anti-virus Expert System of dynamic simulation as the prerequisite, regard judging the unknown virus accurately automatically as and basically demand, control as security mechanism with the procedure behavior.

Defend the concept in the face of being present and varied and initiative, how to distinguish this? Liu Xu points out, like all anti-virus technology, the unknown virus precautionary technology must realize too that judge the properties of the procedure clearly. It is the virus, should call the police and point out users and find the virus clearly. If just the single movements to the procedure call the police, users judge whether this movement is threatened, it is not the initiative defence. The procedure movements spoken herein, mean the anti-virus software controls to the procedure and transfers a certain API that Windows offered. API is the function that Windows offers for program development, the normal procedure can use, the virus can be used too. That is to say, API does not have the difference of good and evil, if only call the police according to a movement of the procedure, then NORMSUB normal subscribers are really difficult to judge whether this movement is harmful on earth, will feel at a loss as to what to do even more, this is not obviously computer user's required anti-virus technology.

In the course of haggling with unknown virus, virtual machine technology, heuristic technology and sandbox technology are edge tolls in the hand of anti-virus manufacturer. The virtual machine technology is the technology that the use virtual machine operates paying and controlling to the computer virus, the virtual machine here means it is totally fictitious (Pure Emulator) . The intersection of virtual machine and technology to transfer whom system,etc. finish through imitate the intersection of CPU and command system, the intersection of memory and supervising system, operating system, API, this is a pure virtual environment, the virus runs among them, totally isolate with the present system. Can realize shell, the intersection of behavior and the intersection of person who judge and many kinds of functions of virus under the virtual environment.

Now, the virtual machine technology has a very large number of application in the antivirus software too, especially in the heuristic technology of killing virus. Heuristic technology screens and possesses the characteristics of virus by some characteristics to the computer virus mainly. Heuristic to divide two kinds: One kind is inspired dynamically, one is inspired by static behavior.

Dynamic inspiration utilizes the above-mentioned virtual machine function, operate the virus under the environment of virtual machine, control the behavior of the virus to realize. For example which have API of danger in the virus call, what key values of registration table are revised, what files,etc. are established. The ones that inspired depended on the virtual machine virtual depth deeply dynamically.

It is generally through mating and measuring the unique key word of virus that the static behavior is inspired. For example can not present the magnetic disc and read and write order int 13 in the Boot sector, through to have int 13 judgement of order come, brief user on, might infect the virus of Boot sector in the 512 sector. We can summarize the character string in some common virus, universal code,etc. to inspire the file to be the virus too, the rate of accuracy of this kind of inspiration is quite high.

Ding Kai, anti-virus expert of Jiang Min Company, introduces to the reporter, sandbox technology is an analog environment too in fact, the virus can run without destroying the system resource in this environment arbitrarily. The difference between it and virtual machine lies in: The operation of the sandbox is with present system resource, such as the execution of API, out of order deployment,etc., generally intercept API by way of hook. The resources that and the virtual machine uses (such as API) Need to come out completely fictitiously by oneself, do not transfer the existing resources of the system. Can understand like this, " initiative defence " that prevailed several years ago Technology was realized through the method of hook API too, it is a kind of technology of judging dynamic behavior in the Windows layer, it is a technical subset of sandbox, only intercept and not track back the function. And sandbox technology can make the virtual environment get back to the procedure a bit more primitive.

Sandbox can can be regarded as one development of virtual machine, his technological principle seem even and the virtual machine is roughly the same, but they still have difference greatly. The sandbox is a kind of more deep intrasystem kernel technology, during a program execution, the sandbox knows the take over procedure and transfers the behavior in the interface or function, and will implement " rolls " after confirming the virus behavior The mechanism, let recover systematically. The virtual machine does not possess and roll to recover the mechanism, after stimulating the virus, the fictitious chance judges it is a certain viroid according to the behavioural trait of the virus, and transfer the engine to remove this virus, there are essential differences between the two.

[kangpw-blog]

Anti-virus products of third generation --The microdot defends the software voluntarily

New technical standard

It is the anti-virus software of the third generation that the microdot defends the software voluntarily, subverting the traditional antivirus software adopts the virus feature code to discern the anti-virus idea of the virus. The microdot defends the software and adopts and defends technology and analyses and judges the virus independently voluntarily voluntarily, it is unable to defend killing the drawback of unknown hobbyhorse and new virus that emerge in an endless stream to solve the antivirus software.

It is the eastern microdot information technology limited company (hereafter referred to as the microdot company) of Beijing that the microdot defends the software voluntarily Third generation anti-virus products with the totally independent intellectual property right researched and developed independently, have realized that defends the technology system voluntarily for the first time in the world, and established the technological new-standard of the anti-virus according to this. The microdot defends the most prominent characteristic of the software voluntarily, except that scanning of proper value check that kills the function of the known virus, have realized even more that analyzes that judges the mechanism of the virus with anti-virus expert's intelligence of simulation of software engineering, find independently and unknown hobbyhorse and new virus of automatic erase.

Develop the background

Though has all installed the anti-virus software of different brands in most users' computer, but a regrettable one is, the virus that users face is endangered and has not reduced notably, the ascendant trend has appeared instead. Meet an urgent need the intersection of processing center and " China computer virus epidemic situation investigate the technological analysis report 2007 " according to national computer virus, by June of 2007, the Chinese computer virus infection rate was up to 91.47%, presented greater rebounding again compared with the past two years. The demand of the anti-virus has been one of the major causes to cause this kind of situation that traditional anti-virus technology has already no longer met at present.

Traditional anti-virus technology - -The scanning of proper value, its key thought is a anti-virus company from the virus body code, extract the proper value of the virus manually, then will be checked by the anti-virus products and like carrying on comparison with virus proper value, contain proper value of virus a certain, make their newspapers the virus check alike.

The virus that the anti-virus company has already drawn proper value is called the known virus, the virus not drawing proper value is called the unknown virus. The scanning of proper value depends on from the extractive proper value in the body of virus, it is unable to make proper value not to obtain body of virus. Its technological principle has determined, the scanning of proper value can only discern the known virus, can't take precautions against the unknown virus.

The technical procedure of the traditional anti-virus is: As users find the computer presents the abnormal phenomena, suspects that may be infected by the virus The users with certain anti-virus knowledge send the suspicious file through routes such as the mail,etc. to the anti-virus company After the anti-virus company receives the suspicious file, are analyzed the engineer carries on artificial analysis by the virus If assert it is the virus, draw the proper value of this virus from the virus code, then make staging procedure and put it on Internet Finally, after the anti-virus software of a staging, could be checked and kills this virus for use. But before user's staging, the anti-virus products on user's computer can't prevent infection and destruction of this virus.

At present, traditional anti-virus technology faces very severe virus challenge, the hacker makes various virus of hobbyhorse taking stealing business secret, fictitious property, account No.,etc. as purpose in batches on a large scale, this kind of profit-making new virus has already become the leading trend of development of present virus. For prevent hobbyhorse from find antivirus software, develop many kinds of easy virus exempt technology of abating hacker, needn't write virus program again, need through add shell, add, spend order, position and revise the intersection of virus and proper value technological treatment of way briefly only, can produce and can escape the traditional anti-virus products and check the hobbyhorse mutation killed in batches on a large scale very in short time.

The more severe one is, have already added the shell automatically, avoided the murderous intention automatically, having even realized commercialization, the virus author upgrades him every day, the staging speed has even exceeded the antivirus software. The hacker utilizes the hobbyhorse mutation of this kind of tool automatic generation, can often have hidden from the checking and killing of the antivirus software of latest edition. The hobbyhorse was produced " Industrialization, automizing " Cause hobbyhorse to be more and more difficult to collect the intersection of anti-virus and Company, in front of collecting hobbyhorse these, these hobbyhorses have longer survival time, have already caused the losses different to retrieve to user.

According to Germany AV test lab, about 5,500,000 appear in 2007 to pass Internet's travelling hostile procedure, the anti-virus company needs to analyze 15,000 to 20,000 new virus per day. This makes average daily work capacity of the anti-virus company increase to 4 times of 2006, 15 times those of 2005 even more.

Traditional anti-virus technology " The virus appears- Collect the virus- Analyze the virus- The virus storehouse of the staging " Handle the mode, though can take precautions against the known virus better, users still face the virus that a large number of anti-virus companies have not collected yet and threat of tens of thousands of new virus of every day, users' information security can not get the effective guarantee.

It has already been irrefutable fact that traditional anti-virus technology lagged behind the technical paces of virus, it has been already demand of the present anti-virus of the inadaptation, so, computer users need one kind urgently can check automatically that kill the anti-virus software of the unknown virus.

[kangpw-blog]

Check that it is the really initiative defence to kill the unknown virus

Initiative defence of the true and false

The microdot defends the most prominent characteristic of the software voluntarily, except that scanning of proper value check that kills the function of the known virus, have realized even more that analyzes that judges the mechanism of the virus with anti-virus expert's intelligence of simulation of software engineering, find independently and the unknown virus of automatic erase.

Since the anti-virus engineer can judge whether a procedure is the virus accurately through behavior of the analysis program, could the the intersection of analysis and judgement and process automation, routinization then? Liu Xu thinks this kind of idea is feasible. The microdot defends technology to just design according to this kind of thinking voluntarily: Through analyzing, summing up, summarizing about the behavioral law of virus, and combine the experience that the anti-virus expert judges the virus, refine into virus and discern the regular knowledge base; Imitate the mechanism that the expert finds the new virus, through the numerous probes distributed in operating system, monitor the run program and transfer various movements of API dynamically, analyze a series of movements of the procedure that makes up the significant behavior through the logical relationship, and then the virus of integrated application discerns regular knowledge, realize that judges the virus automatically.

Liu Xu introduces, defends the technology system and must regard possessing anti-virus Expert System of dynamic simulation as the prerequisite voluntarily, regard judging the unknown virus accurately automatically as and basically demand, control as security mechanism with the procedure behavior.

Defend the concept in the face of being present and varied and initiative, how to distinguish this? Liu Xu points out, like all anti-virus technology, defending technology voluntarily must realize too that judge the properties of the procedure clearly, it is the virus, should call the police and point out users and find the virus clearly. If just the single movements to the procedure call the police, users judge whether this movement is threatened, it is not the initiative defence. The procedure movements spoken herein, mean the anti-virus software controls to the procedure and transfers a certain API that Windows offered. API is the function that Windows offers for program development, the normal procedure can use, the virus can be used too, that is to say API does not have the difference of good and evil. If only call the police according to a movement of the procedure, then NORMSUB normal subscribers are really difficult to judge whether this movement is harmful on earth, will feel at a loss as to what to do even more, this is not obviously computer user's required anti-virus technology.

Strength is refused " the panda burn joss sticks "

" the panda burns joss sticks " The virus is a kind of worm-type virus which China writes, from October of 2006 to February of 2007, cause several million computers of China to be infected and destroyed, influences abominably, losses are enormous.

For shelter from antivirus software, check that abates, the person who writes virus upgrades revising" the panda burns joss sticks " more than times a day Virus program, successively wrote and transmitted several hundred kinds " the panda burnt joss sticks " together Virus. The person who writes virus even leaves a message in the virus, challenge the anti-virus company publicly, haggle after launching the fierceness with anti-virus company of a person who writes virus.

In the trial of strength, " the panda burns joss sticks " After the virus appears and causes some users to damage, the anti-virus company could catch this kind of virus, then upgrade the virus storehouse and offer the management alternative for contaminating in users. However, " the panda burns joss sticks " Mutation speed getting quicker than antivirus software renewal speed even,old " burn joss sticks panda " Not when being been totally wiped out yet, new " the panda burns joss sticks " Have already begun to stir up trouble in the network.

" the panda burns joss sticks " The virus brings in constant renewal in, make the antivirus software forced the constant staging too, but " the panda burns joss sticks " Infection and destruction of the virus have not been contained effectively because of this. In this several months -long trial of strength, the traditional antivirus software is unable to offer effective protection to user, did not come to an end until the person who writes virus is arrested. " the panda burns joss sticks " The technical critical defect of prominent traditional anti-virus of virus, have impelled anti-virus technology to scan to change to the initiative defence from proper value.

In this cruel trial of strength, the microdot defends the software to stand " the panda burns joss sticks " voluntarily Severe test of the virus. At that time, it was that an only one did not need staging to take precautions against " the panda burnt joss sticks " in the world that the microdot defended the software voluntarily Anti-virus products of the virus. A million users using the microdot to defend the software voluntarily have not been infected by the virus, even without staging microdot defend the intersection of software and 2005 edition voluntarily, too can realize until " the panda burnt joss sticks " All the intersection of mutation and accurate the intersection of newspaper and malicious and automatic erase of virus, reflect the intersection of microdot and initiative the intersection of defence and technical advance fully.