E. Filiol : Malware Pattern Scanning Schemes Secure Against Black Box Analysis
 As general rule, copycats produce most of malware variants from an original
malware strain. For this purpose, they widely perform black-box analyses of
commercial scanners aiming at extracting malware detection patterns. In this
paper, we first study the malware detection pattern extraction problem from a
complexity point of view and provide the results of a wide-scale study of
commercial scanners black-box analysis. These results clearly show that most of
the tested commercial products fail to thwart black-box analysis. Such
weaknesses therefore urge copycats to produce even more malware variants. Then
we present a new model of malware detection pattern based on Boolean functions
and identify some properties that a reliable detection pattern should have.
Lastly, we describe a combinatorial, probabilistic malware pattern scanning
scheme that, on the one hand, highly limits black-box analysis and on the other
hand can only be bypassed in the case where there is collusion between a number
of copycats. This scheme can incidentally provide some useful technical
information to malware crime investigators, thus allowing faster copycats'
identification.


M. Rieback : From Cyberspace to your Kitchen:  New Directions in Computer Viruses
Radio Frequency Identification (RFID) is a technology that closely-couples
the virtual and physical worlds. From streamlining supply chains to
simplifying our personal lives, RFID aims to transform the way in which
humans interact with the world. Unfortunately, this seamless integration
of computer chips into everyday life also has a dark side; hackers and
computer virus writers are gaining increased power to manipulate not only
data.. but the physical world itself.

Our research has targeted this paradigm shift by condensing traditional
"hacking" attacks onto memory-constrained RFID tags. In this
presentation, we will define RFID malware (RFID exploits, RFID worms, and
RFID viruses), and highlight some specific application scenarios,
infection mechanisms, and payloads. We will also explain how RFID
middleware writers can prevent these problems.

P. Beaucamps : A new definition of obfuscation

J.-Y. Marion : Recursion Theorem, Information Theory, a theoretical travel in virus land

G. Jacob et M. Le Liard Evaluation methodology of function-based malware
detection
 Sequenced-based viral detection methods and in particular pattern-matching
technics are eventually vowed to fail. As it has been already proved, the
detection of known bounded-length viruses with these technics is of NP-complete
complexity, at least. This result is due to the existence of mutating viruses
using
encryption, polymorphic mutation of decryption routine and metamorphic
generation of their body to evade detection. An alternative method lies in
function-based methods especially behavioral analysis. This article
draws up a state of the art in the implementation of such methods in
present-day antivirus and presents an evaluation of their implementation.

The operating mode is the following. From a known virus whose sources were
available, several main classes of behaviors have been identified. In order
to simulate metamorphic generation mechanisms in a controlled and selective
way, these behaviors have been manually modified. Each generated instance
has been separately tested with both sequenced-based and function-based
methods, on several platforms running different antivirus products.

As a result of this survey, information related to the strategy of detection
used in the tested products can be gathered. The awaited result would be that
the behavioral analysis is simply absent or the ponderating weight it is given
is almost inexistent without a correlation from an other sequenced-based
detection.


InSeon Yoo : Non-Signature Based Virus Detection
Unlike classical virus detection techniques using virus signatures, this
SOM-based approach can detect virus-infected files without any prior
knowledge of virus signatures. Exploiting the fact that virus code is
inserted into a complete file which was built using a certain compiler,
an untrained SOM can be trained in one go with a single virus-infected
file and will then present an area of high density data, identifying the
virus code through SOM projection.

The virus detection approach has been tested on 790 different
virus-infected files, including polymorphic and encrypted viruses. It
detects viruses without any prior knowledge and is therefore assumed to
be highly applicable to the detection of new, unknown viruses.
This non-signature-based virus detection approach was capable of
detecting 84% of the virus-infected files in the sample set, which
included, polymorphic and encrypted viruses. The false positive rate was
30%.

The combination of the classical virus detection technique for known
viruses and this SOM-based technique for unknown viruses can help
systems even more secure.

Stefano Zanero : Issues in modeling user interaction for virus propagation
In this talk we will outline the difficulties we met in properly
modeling complex user interaction and how it affects virus propagation.
In particular, we will show how we modeled the little known Vjerika
virus, in order to try to determine its effectiveness compared to other
mass mailing viruses during criminal prosecution against its
self-confessed author.