1. CVI / PRS Computer Virus Information / Propagation Research System Eric Miller and Brian Schill CS 522

2. Why? There are many viruses that are not researched by the major virus detection companies. There are many viruses that are not researched by the major virus detection companies. We believe this project and research could eventually lead to more successful proactive virus detection systems. We believe this project and research could eventually lead to more successful proactive virus detection systems. Exploring the capabilities of VMWare. Exploring the capabilities of VMWare.

3. Setup and Tools VMWare – Virtual operating system VMWare – Virtual operating system CVI / PRS – Custom software for monitoring software CVI / PRS – Custom software for monitoring software Virus Types Virus Types

4. VMWare Windows 98 guest OS running on Windows XP host. Windows 98 guest OS running on Windows XP host. Disabled networking Disabled networking Easy restoration Easy restoration Controlled environment Controlled environment

5. CVI / PRS Java application that monitors virus activity on the guest OS Java application that monitors virus activity on the guest OS Run on the guest OS Run on the guest OS Watches for changes in the directory Watches for changes in the directory DirWatcher.java DirWatcher.java Virus Database Virus Database

6. Virus Research Example Virus types Win32 Win32 Worms Worms Scripts Scripts Example – Bee Example – Bee Undocumented virus Undocumented virus Run CVI / PRS for results Run CVI / PRS for results

7. Example – Continued Enter initial data into CVI / PRS Enter initial data into CVI / PRS

8. Example Continued Run CVI / PRS Run CVI / PRS

9. Interpretation of Results Win32 Win32 Typically deleted executables Typically deleted executables Damaged system files/registries Damaged system files/registries Corrupted system beyond repair after several reboots Corrupted system beyond repair after several reboots Worms Worms Affected networking files (IPConfig, Traceroute, etc) Affected networking files (IPConfig, Traceroute, etc) Deleted executables Deleted executables Scripts Scripts Replicated themselves efficiently Replicated themselves efficiently Search through file systems to attach themselves to other scripting files Search through file systems to attach themselves to other scripting files Our program effectively identified changes to the OS Our program effectively identified changes to the OS

10. Future Improvements Differentiate between regular and irregular activity Differentiate between regular and irregular activity Various launching capabilities Various launching capabilities Better database scheme Better database scheme XML XML Interpret results Interpret results Severity report, future capability prediction Severity report, future capability prediction Include database for cross-virus predictions and observations Include database for cross-virus predictions and observations Run the program from the host operating system, monitoring the guest operating system Run the program from the host operating system, monitoring the guest operating system Difficult restart Difficult restart Monitor network ports and registry files Monitor network ports and registry files

11. Footnotes Thank you to individuals previously involved in the project Thank you to individuals previously involved in the project Ben Abernathy Ben Abernathy Zach Thomas Zach Thomas Michael May Michael May Initial source code Initial source code Viruses Viruses