Comment by tsally | Hacker News Reader

Comment by tsally | Hacker News Reader

Parent Full thread

Analogies between computer viruses and biological viruses are strained, overused, and abused. I'll just point out that our innate immune system doesn't use signature based detection, it uses a whitelist and behavioral/heuristic based detection. Where do you think transplant rejection comes from? It's not because the immune system has a virus signature that matches the foreign organ.

I'm pretty sure the future of anti-viruses will involve signature matching one way or another, because there's no way around that.

There are numerous ways around it. A whitelist is the simplest way. We have the technology to systematically verify the integrity of each piece of software on a computer (barring physical access) [1]. The current implementations of TPM have the potential for massive privacy violations and abuse, but I'm hopeful that projects like OpenCore will eventually lead to open source TPM designs. In any case, in such a system anti-virus is not even necessary.

More complex but less restrictive methods include:

(1) Building machine learning algorithms around a set of data that measures the normal operation of the machine. Because 99.9999999999% of the time Grandma's computer shouldn't be acting as a server.

(2) A feedback system built into your antivirsus where users report applications that don't work or have malicious behavior. Then Grandma can look up the greeting card creator she wants to install and see that 100 users have given the application 5/5 stars over a period of 6 months. Bonus points for open source applications where people will take the time to audit them for free.

There's tons of research in this area and I don't have time to reproduce a complete summery here. The point is that signature based detection is a method that is not sustainable in the long term because the number of unique malware variants is something that is growing exponentially. Most people don't even have anti-virus installed, and those that do have to deal with the fact that the AV slows the machine to a crawl.

Signature based AV is just a stopgap measure until we can properly implement our operating systems and detection methods. In the future we will have operating systems with trusted computing bases and detection methods based on behavior and crowd sourcing.

[1] http://en.wikipedia.org/wiki/Trusted_Platform_Module

Your immune system uses a wide range of methods to find and fight infection. However, while identification is based on finding things outside of the "Normal" range, fighting it is all about signatures.

Vaccination works by preparing the body to fight something that looks like X by dumping millions of copy of something that looks like X into your body. At which point your immune system feels it needs to really fight X with everything it has so it develops a specific response. aka Adaptive immunity is triggered in vertebrates when a pathogen evades the innate immune system and generates a threshold level of antigen. SEE: http://en.wikipedia.org/wiki/Adaptive_immune_system

This is also why you can have auto immune diseases, if you trip the "fight" response to something that should be left along you get a world of problems. You immune system is more than willing to kill cancer, or even normal cells, and inflammation can be vary harmful.

It's not all about the signatures. Vaccination would be just as ineffective as anti-virus if biological viruses were anything like computer viruses. Imagine billions of biological viruses that are instantly transmitted upon infection to anywhere in the world, have an immediate impact on the host, and can evolve and adapt with human-like intelligence. Good luck fighting that with vaccines.

Because computers are not human beings, if we can do detection well, than the problem of fighting an infection is already solved. Just run your server on a virtual machine verified by a trusted boot module. When an infection is detected, just roll back to a trusted snapshot or roll back to a clean install.

Remember less than 1/2 the cells in your body actually contain your DNA. Yet signatures still work. Biological viruses are light years ahead of computer viruses. Picture a world where there where more computer virus strains than computers, they mutated millions of times a second, ignored firewalls and could attack computers though the electrical system. Further 1/4th of every nations GDP went to anti virus systems and had been for the last billion years.

PS: Virus writers have become far more tame but old school virus's would rewrite your BIOS.

any idea where I could learn more about curent implementations of (1) ?

Find a video of this Blackhat talk from 2005. Pretty sure it's in the iTunes store in the podcast section. The video covers pretty much everything you need to know about the theory of such systems.

http://www.blackhat.com/html/bh-usa-05/bh-usa-05-speakers.ht...

As far as actual implementation, I'm not aware of a system that does this. Although honestly some researcher has probably implemented such a system in a paper somewhere. There's probably a commercial network IDS that does it too. I haven't been doing this long enough to be an expert in the field, so I can't confidently say what the true state of the art is in behavioral detection. I'm pretty sure there are no open source projects though if that's what you're asking.

If you're thinking about implementing your own, I'd say start at the network level and write a simple program that sets an alarm off when a specific host starts responding to HTTP requests. If you want to get complex, use Wireshark to log all your network traffic for a month. You can then use Bayesian learning to determine whether new traffic is out of the ordinary. SSH traffic is problematic, so if you need to allow such traffic you'll have some additional challenges to overcome.

Starting an open source project related to this is on my TODO list, but I'm focusing on demonstrating the hopelessness of signature based detection first.

Good luck. And thanks for the links, I'll be looking into it. You mind a PM if it get's interesting (just to bounce ideas off someone)? I'm looking into machine learning stuff myself and can imagine some interesting integrations with this subject.

Definitely don't mind.

Email: tss AT timsally DOT com

Public key if you need: http://www.timsally.com/static/tss.asc

I'm presenting a metamorphic engine at a hacking conference in April (http://thotcon.org/). It'll be completely open source. Initial tests against modern anti-virus look very good. ;)

Reply on news.ycombinator.com