Formalization of viruses and malware through process algebras

Grégoire Jacob (1, 2) , Eric Filiol (1) , Hervé Debar (3, 2, 4)

1 ESIEA - Ecole Supérieure d'Informatique Electronique Automatique [Paris]
2 Orange Labs [Issy les Moulineaux]
3 R3S-SAMOVAR - Réseaux, Systèmes, Services, Sécurité
4 CNRS - Centre National de la Recherche Scientifique

Abstract virology has seen the apparition of successive viral models, all based on Turing-equivalent formalisms. Considering recent malware, these are only partially covered because functional formalisms do not support interactive computations. This article provides a basis for a unified malware model, founded on the Join-Calculus. In terms of expressiveness, the process-based model supports the fundamental notion of self-replication but also interactions, concurrency and non-termination to cover evolved malware. In terms of protection, detection undecidability and prevention by isolation still hold. Additional results are established: calculus fragments where detection is decidable, definition of a non-infection property, potential solutions to restrict propagation

Mots clés: Malware; Process algebra; Detection; Prévention

Domaines: Réseaux et télécommunications [cs.NI]

Grégoire Jacob, Eric Filiol, Hervé Debar. Formalization of viruses and malware through process algebras. WAIS 2010 : 4th International Workshop on Advances in Information Security, Feb 2010, Krakow, Poland. pp.597 - 602, ⟨10.1109/ARES.2010.59⟩. ⟨hal-01355337⟩