It is not necessary that a pattern of bytes in the code of malware represent the signature.
A signature in general, helps us identify the malware uniquely based on its characteristics. Below are the characteristics that go into consideration while defining a signature for the malware.
- Network Based: This includes comparison of network traffic with known
IOC's (IPs) that are categorized as Command and Control servers
controlling the Botnet(infected hosts). ex: Trojans, APT
- Host Based: This checks port scans over the network to increase
the foot hold by infecting other hosts. ex: Worm
- Application Based: This checks for presence of strings in a program
that can do privilege escalations , cause OS corruption, importing
critical DLLs that are in general not required. ex: virus
There is also Heuristic detection, that is used to define the signature of a malware.
Based on the above detection methods, if any of the symptoms are seen by the malware, it is categorized in that major signature type like Worm, Trojan, Heuristic etc.