1

I made an experimental AV application to detect some test files as malware. It uses a simple signature based detection to detect those files. When my test AV encounters a file, it computes the SHA256 hash of that file, and then compares it with a database of hashes that are "deemed" malware. It will then either quarantine or delete that detected file... I realized that this method was very naive and will never offer any protection against zero day attacks or detect viruses whose hashes are not in the database. Also, professional AV software use sandboxing and API hooking to detect suspicious activity of executables. But consider this hypothetical case:

If I have the MD5 or SHA256 hashes of all known viruses till date in this world, will using only signature based detection give protection to my user.

In this age of self replicating viruses is signature based malware detection still used by Anti malware software to detect computer viruses or does it have some other applications when dealing with malware? What if the OS in which an Antivirus Software runs on does not give permission for API hooking or the system does not have enough resources (RAM) for sandboxing, then will signature based detection have some application ?

Improve this question
5
  • 1
    Not just professional AV software use sandboxing. Have you heard of cuckoo filters, e.g., github.com/cuckoosandbox/cuckoo ? Cuckoo Sandbox is the leading open source automated malware analysis system. What does that mean? It simply means that you can throw any suspicious file at it and in a matter of seconds Cuckoo will provide you back some detailed results outlining what such file did when executed inside an isolated environment.
    – auspicious99
    Commented Apr 18, 2020 at 8:48
  • 1
    and see also security.stackexchange.com/questions/438/…
    – auspicious99
    Commented Apr 18, 2020 at 8:49
  • 1
    Purely signature based AV detections are not useless but it is now considered “old”. Nowadays, AV/EDR is looking at what the program does to determine if it’s malware. But they also use signatures b/c it does catch a lot of commodity malware.
    – pm1391
    Commented Apr 18, 2020 at 12:58
  • @pm1391 I feel signature based detection is the only method possible if an antivirus has limited permission on an OS ! For example in Android third party apps cannot have full access to other apps execution
    – Aravind A
    Commented Apr 18, 2020 at 13:06
  • 1
    Yes if the AV does not operate at kernel level, it will be pretty ineffective
    – pm1391
    Commented Apr 18, 2020 at 13:17

1 Answer 1

Reset to default
2

Signature Based Malware is still the dominant mechanism used.

Heuristic mechanisms do exist and are very useful in limited circumstances, but are subject to too many false positives for more general use.

What has happened in the AV industry across the board is an application of "Big Data". It's no longer a case of just checking against a database of known bad signatures. Most AV vendors, including Microsoft, will check the hash of all executables. That hash check can have three main results:

  1. Known Bad (Isolate, Done!)
  2. Know Good (continue, Done!)

  3. Unknown (Scan for virus signatures)

    A. Signature Found (Isolate, Done!)

    B. Send a copy to the AV Vendor for Analysis

The immediate enhancement over your example test AV is the incorporation of Known Good hashes.

The less obvious but very powerful enhancement is the Big Data factor. When the AV company is doing this all over the world against billions of files, the chances of any given individual encountering a new 0-day drops dramatically, although it does still happen.

If you make your own executable, malicious or not, the third case will kick in. Microsoft, or most other large AV Vendors, will pull a copy of your executable and send it to their analysis teams. Here they will use heuristics during analysis and depending upon complexity, it will be fairly quickly entered into the worldwide database of executables.

Improve this answer
4
  • Thankyou for your answer ! But can you please tell me how will an AV detect malicious scripts ? Just a slight change in the text of a script (say a python script) will cause a different Cryptographic hash for it ! In that case will the AV have to shutdown the Python Interpreter forever ?
    – Aravind A
    Commented Apr 18, 2020 at 18:43
  • @Vivekanand V - I just added a detail update, you may have missed it. Virus signatures are not dependent upon the hash, they only make for a quick good/bad triage. Unknowns, including scripts, are scanned for signatures not hashes. You would have to know and alter the signature being used, an arbitrary script change will likely not do that as signatures are selected based upon key functionality.
    – user10216038
    Commented Apr 18, 2020 at 18:49
  • Can you please tell me how virus signatures are practically created, and how are they generated at runtime to match with the database and in what part of this protocol does Cryptographic hashing comes into play ?
    – Aravind A
    Commented Apr 18, 2020 at 18:51
  • 1
    @Vivekanand V - Generally virus signature creation is a manual art. The trick is to define a signature that is likely sufficient and unique. If it's overly specific, minor variants will not be detected. If it's not unique, it generates false positives. Hashing is a quick triage before deciding to signature scan.
    – user10216038
    Commented Apr 18, 2020 at 19:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .