Medical Informatics. Учебное пособие

necessary for its operation which is stored in the system memory areas, and even, according to one of unverified computer legends contribute to the rapid wear of moving parts of mechanisms, that is to enter into resonance and to destroy the heads of some types of hard drives.

12. Classification of antivirus software

12.1 General information

Antivirus software are the programs, whose main task is to protect it from viruses, or, more precisely, from malicious software.

In theory principles and methods for protection are of no particular importance. What is most important that they are aimed at fighting against malicious software. But in practice, the situation is somewhat different: almost any antivirus program combines in different proportions all technologies and methods to protect against viruses, created by now.

All methods of antivirus protection can be divided into two main groups:

•signature-based detection - accurate methods of virus detection, based on comparing the file with known virus samples.

•heuristic analysis - the approximate detection methods that allow a certain chance to assume that the file is infected.

12.2 Signature analysis

The word “signature” in this case is a calque from the British word, meaning

“subscription” or metaphorically "characteristic feature, identifying something." Actually, it speaks for itself. Signature analysis consists in identifying specific features of each virus, and virus detection by comparing the identified features.

Virus signatures will be considered as a set of features that allows to identify the virus in a file (including the cases when the entire file is a virus). All together the signatures of the known viruses constitute antivirus database.

The problem of signature allocation as a rule is solved by people - experts in the field of computer virology, who are able to isolate the virus code from the code of the program and formulate its characteristic features in the most convenient form for

31

search. In most simple cases automated signature allocation can be used, for example, in case of trojans or worms based on simple structures that do not infect other programs, but are completely malicious programs.

Almost every company that produces antivirus software has its own team of experts performing analysis of new viruses and replenishing antivirus database with new signatures. For this reason, antivirus databases in different antiviruses are different. However, there is an agreement between antivirus companies on the exchange of virus samples and, therefore, sooner or later a new virus signature enters antivirus databases of almost all antivirus software. The best antivirus is the one for which the signature of a new virus was released before anyone else.

An important additional feature of signatures is the exact and guaranteed definition of virus type. This feature allows to add not only signatures but also the ways to treat the virus. If signature analysis gave only answer to the question about the presence of the virus, but did not give the information about the virus type, the treatment, obviously, would not be possible - the risk of making the wrong action and obtaining additional loss of information instead of treatment would be too big.

Another important, but negative feature is the fact that it is necessary to have a sample of the virus in order to obtain the signature. Therefore, the signature method is unsuitable for protecting against new viruses, because while the virus has not got on the analysis of the experts, it is impossible to create its signature. That is why all the largest epidemics are caused by new viruses. It usually takes a few hours from the appearance of a virus in the Internet till the first signatures release, and during this time the virus is able to infect computers almost unimpeded. Almost - because additional virus protection software discussed above, as well as heuristic methods used in antivirus programs helps in protection against new viruses.

12.3 Heuristic analysis

The word "heuristic" is derived from the Greek verb "to find". The essence of heuristic methods is that the solution to the problem is based on certain plausible assumptions, rather than on strict conclusions from the available facts and

32

preconditions. Since this definition sounds complicated and not clear enough, it is easier to explain it with examples of various heuristic methods.

12.4 Virus scan, similar to known

The signature method is based on the extraction of virus signatures and the search for characteristic features of the virus in the scanned files, while the heuristic analysis is based on the (highly plausible) assumption that new viruses are often similar to any of the known ones. Post factum this assumption is justified by the presence of signatures in anti-malware databases to determine not one but several viruses. Based on this assumption, the heuristic method involves the search for files that are not fully, but very close match signatures of known viruses.

The positive effect of using this method is the ability to detect new viruses long before signatures extraction.

Negative aspects are:

•The probability to determine mistakenly the presence of a virus in a file, when in fact the file is clean. Such events are called false positives (false virus alarm).

•The impossibility of treatment – both because of possible false positives, and because of possible in accurate determination of the virus type. An attempt to treat can lead to more information loss than the virus itself, and that is unacceptable.

•Low efficiency - against really innovative viruses causing the most largescale epidemics. This kind of heuristic analysis is of little use.

12.5 Scanning for viruses, performing suspicious actions

Another method based on heuristics, proceed from the assumption that the malware somehow tend to harm the computer. The method is based on selection of key malicious actions, such as:

•deleting a file;

•file writing;

•writing into specific areas of the system registry;

•opening a port for listening;

33

•interception of data entered from the keyboard;

•e-mailing;

•others.

The advantage of this method is the ability to detect previously unknown malicious programs, even if they are not similar to those already known. For example, a new malware can be used to penetrate into the computer a new security vulnerability, but then it begins to perform habitual malicious actions. Such a program may be missed by the heuristic analyzer of the first type, but it can be detected by the analyzer of the second type.

The negative features are the same as above mentioned:

•false positives

•impossibility of treatment

•low efficiency

12.6 Additional resources

Almost any antivirus today uses all known methods of virus detection. But some means of detection are not enough for successful work of antivirus program, so we need additional modules performing auxiliary functions to ensure that purely antivirus tools are effective.

12.7 Update module

Primarily, each virus must include update module. This is due to the fact that the main method of virus detection today is signature analysis, which relies on the use of antivirus database. To ensure that signature analysis deals effectively with the latest viruses, security experts are constantly analyzing the samples of new viruses and release signatures for them. Once this is done, the main problem is to deliver signatures on each user’s computer using the appropriate antivirus program.

That is precisely the task which update module solves. After experts have created new signatures, files with signatures are placed on the servers of antivirus manufacturers and companies and become available for downloading. The update

34

module accesses these servers, detects new files, uploads them to the user’s computer and gives the command to antivirus modules to use the new signature files.

12.8 Planning module

The second important auxiliary module is a planning module There are a number of actions that antivirus should perform regularly, including checking the entire computer for viruses and updating antivirus database. Update module exactly allows to adjust the frequency of implementation of these actions.

To update the virus database it is recommended to use a small interval - one or three hours, depending on the capabilities of the network access channel. Currently, new versions of malicious programs are constantly detected, forcing antivirus companies to produce new signature files almost every hour. If the computer user spends a lot of time on the Internet, it endangers computer security and therefore antivirus database should be updated as often as possible.

Full computer scan should be performed because new malicious programs appear first, and only after that the signatures to them, and therefore there is always the danger to download malware onto computers before the virus database updates. To detect the malware, the computer must be periodically retested. Once a week is a reasonable schedule to check your computer.

12.9 Data management unit (Unit control module)

With increasing number of modules in the antivirus there is a need for additional module for management and configuring. In the simplest case it is a common interface module by which one can gain access to the most important functions in a convenient way:

•configuring parameters of antivirus modules;

•configuring update settings;

•configuring periodic run of update and verification;

•starting (launching) modules manually on user’s demand;

•scan (check) report;

35

• other functions, depending on certain antivirus.

12.10 Quarantine

In many antivirus software there are special technologies among other aids protecting against possible data loss due to antivirus actions.

For example, it is easy to imagine a situation in which a file is detected as potentially infected with heuristic analyzer and it is removed according to the antivirus settings. However, the heuristic analyzer never gives an absolute guarantee that the file is really infected, so with a certain probability antivirus could remove an uninfected file.

Or antivirus detects an important document infected by the virus and tries to perform treatment according to settings, but for some reason fails and important information is lost together with a virus which was cleaned up.

Of course, in such cases, it is desirable to get insured. The easiest way to do this is to save their data backup before treatment or removing files, then if it appears that the file has been deleted by mistake or important information was lost, you can always restore them from data backup.

13. Protecting information from network attacks

The threat can be any person, object or event which, if implemented, could potentially cause harm to the local area network (LAN). Threats may be malicious, such as the deliberate modification of critical information, or may be accidental, such as miscalculation or accidental file deletion. The threat may also be a natural phenomenon, such as a flood, hurricane, lightning, etc. The direct damage

caused by the threat is called the impact of security threats.

Pain points are security weak points in the LAN that can be used by the threat for its implementation. For example, unauthorized access (threat) to the LAN can be carried out by an unauthorized person who guessed the obvious password. Pain (weak) point in this case is a bad password chosen by the user. Reducing or limiting the LAN vulnerability can reduce or eliminate the risk from LAN. For example, a

36

tool that can help users to choose a robust password, can reduce the possibility that users will use weak passwords, and by this way to reduce the threat of unauthorized access to the LAN.

Protection Service is the whole set of protection mechanisms that support

their data files and organizational measures to help protect the LAN from

specific threats. For example, authentication and identification service helps to protect LAN from unauthorized access to the LAN, requiring the user to identify himself/herself and confirm the truth of his/her identity. Information security tool is as reliable as the mechanisms, procedures and so on that maintain it.

Protection mechanisms are security data facilities implemented to provide security services needed for LAN protection. For example, the authentication system based on the use of smart cards (which assumes that the user possesses the required smart card), may be a mechanism implemented to ensure the identification and authentication services. Other mechanisms, which help to maintain the confidentiality of authentication information, may also be considered as part of identification and authentication service.

13.1 Threats and vulnerabilities

Identification of threats involves consideration of the impacts and consequences of threats. Exposure to threats, which typically involves the problems encountered immediately after implementation of the threat leads to disclosure, modification, destruction or denial of service. More significant long-term consequences of threats lead to loss of business, breach of confidentiality, violation of civil rights, loss of data adequacy, loss of human life or other long-term effects. The consequences of the threats will be discussed in section 3, Risk management. The approach described here lies in classification of types of impacts which may occur on a LAN, so that specific technical threats could be grouped together according to their effects and studied in some way. For example, such technological threats, the implementation of which results in exposure of "LAN traffic compromise" can be separated from those threats, which involve exposure of

37

"Malfunction of LAN." It should be understood that the implementation of many threats leads to more than one exposure, but in the context of this discussion each threat will be considered in connection with only one exposure. The effects that will be used to classify and discuss the threats to LAN environment are:

Unauthorized access on the LAN occurs when a person obtain an

unauthorized access on the LAN.

Inadequate access to the LAN resources occurs as a result of access on the LAN resources by authorized or unauthorized person.

Data disclosure occurs as a result of access to the information or its reading by a person and possible disclosure of the information in accidental or intentional unauthorized way.

Unauthorized modification of data and programs is a result of data and LAN modification, removal or destruction by a person in unauthorized or accidental way .

LAN traffic disclosure is the result of obtaining access to the information or its reading by a person and possible disclosure in accidental and authorized intentional way when information is transmitted over the LAN.

LAN traffic substitution is the result of the appearance of messages that look like as if sent by the legitimate claimed sender, but actually they are not sent by him/her.

LAN nonperformance occurs as a result of threats that do not allow LAN resources be available in due time.

One of the benefits of the LAN is that a large amount of resources is readily available for many users, that is better than each user ownership of the limited resources allocated to him/her. These resources may include file memory, applications, printers, data etc.

Disclosure of data or LAN soft ware occurs when access to data or software is realized and when they are read and perhaps disclosed to some person who does not have access to the data.

38

Password system can be effective if managed properly, but it does not happen very often. Authentication that relies exclusively on passwords often can not provide adequate protection for AS for several reasons. Users tend to create passwords that are easy to remember and therefore easy to guess. On the other hand, if the users have to use passwords generated from odd symbols that are difficult to guess, it is also difficult for the users to remember them. This makes the user to record a password anywhere, and most likely in a place that is easily accessible during operation.

Proper password selection (a compromise between simplicity for remembering by the user and the difficulty to guess by another person) has always been a problem. Password generators, which create passwords consisting of pronounceable syllables, allow you to create more memorable passwords than those that are created by generators that produce strings consisting of odd symbols.

Password strength checkers are the programs that allow the user to determine whether the new passwords are easy-to-guess and therefore unacceptable.

Customer data and information confidentiality service may be used when secrecy of information is necessary. As the front defense line, this service may include mechanisms associated with access control service, but may also rely on encryption to ensure greater secrecy.

Information encryption converts it into obscure form called cipher text, and decryption transforms the information back to its original form. Sensitive (critical) information can be stored in encrypted form, as the cipher text. Thus, if the access control service will be bypassed, the file can be accessed, but the information will still be protected because it is stored in encrypted form. (The use of encryption can be critical on a PC which does not provide access control service as the front defense line).

It is very difficult to control unauthorized access to the traffic data network when it is transmitted over the LAN. Many users of the LAN are aware of and understand the problem. Using encryption reduces the risk of any interception and reading of messages transiting via LAN messages, making the message unreadable to

39

those who will be able to intercept them. Only an authorized user who has the correct key can decrypt the message after receiving it.

The types of security mechanisms that could be implemented to ensure message and data privacy service are listed below.

Mechanisms

-technology or files and messages encryption;

-backup files protection on the tapes, floppy disks, etc.;

-physical protection of the LAN physical environment and devices.

The use of encryption technology is based on a remarkable property of cryptographic systems. This property lies in the fact that the encrypted message does not contain the secret and can be openly transmitted and stored. The whole secret is found in the key, so the processing of information contained in the message is only possible for those who own the key.

The key as opposed to the message is very small and convenient for storage on external devices. Methods for secret key distribution between users are developed in the theory of cryptosystems which allows to use such keys easily.

13.2 Overview of the Internet

The Internet is one of the most outstanding inventions of our time. It is a global network, which allows you to connect millions of computers with each other from around the world. The Internet possibilities are enormous. While sitting in front of the monitor of a PC connected to the network, you can read news and books, listen to music and radio, learn and play, send and receive emails. There are no borders and distance for the Internet.

The Internet is a different, "higher" level of existence, the global information system that is logically interconnected by unique address space based on the Internet Protocol (IP), the most dynamically developing system of mass media. It surpasses in its information content all existing means of communication. It is not restricted by any boundaries and volumes. The Internet is increasingly influencing the public consciousness.

40