THE ART OF COMPUTER VIRUS RESEARCH AND DEFENSE [Electronic resources] نسخه متنی

اینجــــا یک کتابخانه دیجیتالی است

با بیش از 100000 منبع الکترونیکی رایگان به زبان فارسی ، عربی و انگلیسی

جستجو بر اساس ... همه عنوان پدیدآور موضوع یادداشت تمام متن
اصطلاحنامه مجموعه ها مرورالفبایی لغت نامه دهخدا
➟
جستجو در لغت نامه
بیشتر
کتابخانه شخصی پرسش از کتابدار ارسال منبع

THE ART OF COMPUTER VIRUS RESEARCH AND DEFENSE [Electronic resources] - نسخه متنی

Peter Szor

| نمايش فراداده ، افزودن یک نقد و بررسی
افزودن به کتابخانه شخصی
میخواهم بخوانم
درحال خواندن
خوانده شده
ارسال به دوستان

آدرس پست الکترونیک گیرنده :

آدرس پست الکترونیک فرستنده :

نام و نام خانوارگی فرستنده :

پیغام برای گیرنده ( حداکثر 250 حرف ) :

کد امنیتی را وارد نمایید

ارسال
جستجو در متن کتاب
بیشتر
تنظیمات قلم

فونت

اندازه قلم

+ - پیش فرض

حالت نمایش

روز نیمروز شب
➟
جستجو در لغت نامه
بیشتر
لیست موضوعات

  • Acknowledgments

    Contact Information

    Part I. STRATEGIES OF THE ATTACKER

    Chapter 1. Introduction to the Games of Nature

    Section 1.1. Early Models of Self-Replicating Structures

    Section 1.2. Genesis of Computer Viruses

    Section 1.3. Automated Replicating Code: The Theory and Definition of Computer Viruses

    References

    Chapter 2. The Fascination of Malicious Code Analysis

    Section 2.1. Common Patterns of Virus Research

    Section 2.2. Antivirus Defense Development

    Section 2.3. Terminology of Malicious Programs

    Section 2.4. Other Categories

    Section 2.5. Computer Malware Naming Scheme

    Section 2.6. Annotated List of Officially Recognized Platform Names

    References

    Chapter 3. Malicious Code Environments

    Section 3.1. Computer Architecture Dependency

    Section 3.2. CPU Dependency

    Section 3.3. Operating System Dependency

    Section 3.4. Operating System Version Dependency

    Section 3.5. File System Dependency

    Section 3.6. File Format Dependency

    Section 3.7. Interpreted Environment Dependency

    Section 3.8. Vulnerability Dependency

    Section 3.9. Date and Time Dependency

    Section 3.10. JIT Dependency: Microsoft .NET Viruses

    Section 3.11. Archive Format Dependency

    Section 3.12. File Format Dependency Based on Extension

    Section 3.13. Network Protocol Dependency

    Section 3.14. Source Code Dependency

    Section 3.15. Resource Dependency on Mac and Palm Platforms

    Section 3.16. Host Size Dependency

    Section 3.17. Debugger Dependency

    Section 3.18. Compiler and Linker Dependency

    Section 3.19. Device Translator Layer Dependency

    Section 3.20. Embedded Object Insertion Dependency

    Section 3.21. Self-Contained Environment Dependency

    Section 3.22. Multipartite Viruses

    Section 3.23. Conclusion

    References

    Chapter 4. Classification of Infection Strategies

    Section 4.1. Boot Viruses

    Section 4.2. File Infection Techniques

    Section 4.3. An In-Depth Look at Win32 Viruses

    Section 4.4. Conclusion

    References

    Chapter 5. Classification of In-Memory Strategies

    Section 5.1. Direct-Action Viruses

    Section 5.2. Memory-Resident Viruses

    Section 5.3. Temporary Memory-Resident Viruses

    Section 5.4. Swapping Viruses

    Section 5.5. Viruses in Processes (in User Mode)

    Section 5.6. Viruses in Kernel Mode (Windows 9x/Me)

    Section 5.7. Viruses in Kernel Mode (Windows NT/2000/XP)

    Section 5.8. In-Memory Injectors over Networks

    References

    Chapter 6. Basic Self-Protection Strategies

    Section 6.1. Tunneling Viruses

    Section 6.2. Armored Viruses

    Section 6.3. Aggressive Retroviruses

    References

    Chapter 7. Advanced Code Evolution Techniques and Computer Virus Generator Kits

    Section 7.1. Introduction

    Section 7.2. Evolution of Code

    Section 7.3. Encrypted Viruses

    Section 7.4. Oligomorphic Viruses

    Section 7.5. Polymorphic Viruses

    Section 7.6. Metamorphic Viruses

    Section 7.7. Virus Construction Kits

    References

    Chapter 8. Classification According to Payload

    Section 8.1. No-Payload

    Section 8.2. Accidentally Destructive Payload

    Section 8.3. Nondestructive Payload

    Section 8.4. Somewhat Destructive Payload

    Section 8.5. Highly Destructive Payload

    Section 8.6. DoS (Denial of Service) Attacks

    Section 8.7. Data Stealers: Making Money with Viruses

    Section 8.8. Conclusion

    References

    Chapter 9. Strategies of Computer Worms

    Section 9.1. Introduction

    Section 9.2. The Generic Structure of Computer Worms

    Section 9.3. Target Locator

    Section 9.4. Infection Propagators

    Section 9.5. Common Worm Code Transfer and Execution Techniques

    Section 9.6. Update Strategies of Computer Worms

    Section 9.7. Remote Control via Signaling

    Section 9.8. Intentional and Accidental Interactions

    Section 9.9. Wireless Mobile Worms

    References

    Chapter 10. Exploits, Vulnerabilities, and Buffer Overflow Attacks

    Section 10.1. Introduction

    Section 10.2. Background

    Section 10.3. Types of Vulnerabilities

    Section 10.4. Current and Previous Threats

    Section 10.5. Summary

    References

    Part II. STRATEGIES OF THE DEFENDER

    Chapter 11. Antivirus Defense Techniques

    Section 11.1. First-Generation Scanners

    Section 11.2. Second-Generation Scanners

    Section 11.3. Algorithmic Scanning Methods

    Section 11.4. Code Emulation

    Section 11.5. Metamorphic Virus Detection Examples

    Section 11.6. Heuristic Analysis of 32-Bit Windows Viruses

    Section 11.7. Heuristic Analysis Using Neural Networks

    Section 11.8. Regular and Generic Disinfection Methods

    Section 11.9. Inoculation

    Section 11.10. Access Control Systems

    Section 11.11. Integrity Checking

    Section 11.12. Behavior Blocking

    Section 11.13. Sand-Boxing

    Section 11.14. Conclusion

    References

    Chapter 12. Memory Scanning and Disinfection

    Section 12.1. Introduction

    Section 12.2. The Windows NT Virtual Memory System

    Section 12.3. Virtual Address Spaces

    Section 12.4. Memory Scanning in User Mode

    Section 12.5. Memory Scanning and Paging

    Section 12.6. Memory Disinfection

    Section 12.7. Memory Scanning in Kernel Mode

    Section 12.8. Possible Attacks Against Memory Scanning

    Section 12.9. Conclusion and Future Work

    References

    Chapter 13. Worm-Blocking Techniques and Host-Based Intrusion Prevention

    Section 13.1. Introduction

    Section 13.2. Techniques to Block Buffer Overflow Attacks

    Section 13.3. Worm-Blocking Techniques

    Section 13.4. Possible Future Worm Attacks

    Section 13.5. Conclusion

    References

    Chapter 14. Network-Level Defense Strategies

    Section 14.1. Introduction

    Section 14.2. Using Router Access Lists

    Section 14.3. Firewall Protection

    Section 14.4. Network-Intrusion Detection Systems

    Section 14.5. Honeypot Systems

    Section 14.6. Counterattacks

    Section 14.7. Early Warning Systems

    Section 14.8. Worm Behavior Patterns on the Network

    Section 14.9. Conclusion

    References

    Chapter 15. Malicious Code Analysis Techniques

    Section 15.1. Your Personal Virus Analysis Laboratory

    Section 15.2. Information, Information, Information

    Section 15.3. Dedicated Virus Analysis on VMWARE

    Section 15.4. The Process of Computer Virus Analysis

    Section 15.5. Maintaining a Malicious Code Collection

    Section 15.6. Automated Analysis: The Digital Immune System

    References

    Chapter 16. Conclusion

    Further Reading

    Index

    •
    توضیحات
    افزودن یادداشت جدید











  • Index

    [SYMBOL]
    [A]
    [B]
    [C]
    [D]
    [E]
    [F]
    [G]
    [H]
    [I]
    [J]
    [K]
    [L]
    [M]
    [N]
    [O]
    [P]
    [Q]
    [R]
    [S]
    [T]
    [U]
    [V]
    [W]
    [X]
    [Y]
    [Z]

    p-code

    macro viruses 2nd

    packed code sections 2nd

    packers
    [See compression]

    packers, run-time

    packets

    decoders

    PAE (Physical Address Extension)

    page directories (memory)

    page directory entries (PDEs)

    page frames (memory)

    page table entry (PTE)

    page tables (memory)

    PAGE_READONLY access

    paging

    memory scanning and 2nd 3rd

    Palm platform

    resource-dependent viruses

    Palm/Phage (virus)

    parasitic viruses
    [See classic parasitic viruses (infection technique)]

    parsing files

    for e-mail addresses 2nd

    partition table (PT) entries

    changing 2nd

    partitions

    definition of 2nd

    password cracking

    Morris worm

    password handling

    vulnerabilities

    password protection

    password-capturing attacks

    password-stealing Trojans

    definition of

    passwords

    security problems 2nd 3rd

    Pasteur (antivirus program) 2nd

    patches

    to import address table (IAT)

    patching code in active pages 2nd

    Pathogen (virus)

    X-RAY scanning

    patterns

    matching

    of computer viruses

    worm behavior 2nd 3rd 4th 5th 6th 7th 8th 9th 10th

    PaX (kernel mode extension) 2nd

    payload activation

    accidentally destructive payload viruses

    highly destructive payload viruses 2nd 3rd 4th 5th 6th 7th

    no-payload viruses 2nd

    nondestructive payload viruses 2nd 3rd 4th 5th 6th

    of worms 2nd

    somewhat destructive payload viruses 2nd 3rd

    types of

    W32/Simile virus 2nd 3rd

    PDEs (page directory entries)

    PDF viruses 2nd

    PDF/Yourde (virus)

    PE (portable executable) applications

    PE (portable executable) file format 2nd

    infection techniques 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th

    PE files

    entry points

    infection by W95/Zmist virus 2nd

    infection techniques 2nd

    Windows CE

    PE header

    avoiding infection

    code section sizes

    infection

    multiple headers

    SizeOfCode field

    virtual size

    PE viruses 2nd 3rd 4th

    PEDUMP 2nd

    PeElf (virus)

    peer-to-peer network attacks

    worm infections 2nd

    peer-to-peer network control (worms) 2nd 3rd 4th

    peer-to-peer networks

    Linux/Slapper worm 2nd

    PEID tools

    Pentium II processors

    sysenter

    Perl viruses 2nd

    permutation

    complex permutation techniques (metamorphic viruses) 2nd 3rd 4th 5th

    simple permutation techniques (metamorphic viruses) 2nd 3rd 4th

    W95/Zmist virus

    Perriot, fFederic

    Perriot, Frederic 2nd

    personal firewalls [See also firewalls]

    Phager (virus)

    Phalcon-Skism Mass Produced Code Generator (PS-MPC) 2nd

    phishing attacks 2nd 3rd

    definition of

    phones

    wireless mobile worms 2nd 3rd

    PHP viruses 2nd

    PHP/Caracula (virus)

    PHP/Feast (virus)

    Physical Address Extension (PAE)

    Pietrek, Matt

    PIF viruses 2nd

    Pile, Christopher (virus writer)

    Ping Pong (virus)

    pings

    W32/Welchia (worm)

    platform dependency

    of macro viruses 2nd

    platform support for Win32 2nd 3rd

    Playgame (virus)

    nondestructive payload viruses

    Ply (virus)

    self-protection technique

    Pobresito (virus)

    Polimer.512.A (virus)

    infection technique

    polymorphic decryptor

    W32/Simile virus 2nd

    polymorphic decryptors

    interrupts in

    polymorphic macro viruses

    polymorphic PHP viruses

    polymorphic viruses

    1260 virus 2nd

    32-bit polymorphic viruses 2nd 3rd 4th 5th

    MtE (mutation engine) 2nd 3rd

    polymorphic worms 2nd

    polymorphism

    virus detection 2nd 3rd 4th 5th

    Popp, Joseph

    port 80 (HTTP), NetCat

    port I/O

    disk access 2nd

    portable executable (PE) applications

    portable executable (PE) file format 2nd

    infection techniques 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th

    ports

    monitoring

    PPE (Prizzy polymorphic engine)

    predefined class table (network scanning) 2nd 3rd 4th

    prefetch-queue attacks 2nd

    prepending viruses

    with encrypted host file headers 2nd

    prepending viruses (infection technique) 2nd 3rd 4th 5th

    preprocessors

    network intrusion detection system (NIDS)

    printers

    targeted by worms

    private pages, Win32 viruses that allocate

    Prizzy (virus writer)

    W32/Crypto virus

    Prizzy polymorphic engine (PPE)

    process address space randomization

    PROCESS_TERMINATE access

    PROCESS_VM_OPERATION access

    processes

    computer virus analysis 2nd 3rd 4th 5th 6th 7th 8th

    context (memory scanning) 2nd

    enumerating

    memory scanning 2nd

    monitoring

    terminating

    user address space of (scanning)

    viruses in 2nd

    profiles

    decryptors

    tracking

    program shepherding

    buffer overflow attacks (worms) 2nd

    Programmer's Guide to the IBM PC (Norton)

    propagation (worms)
    [See code propagation techniques (worms)]

    ProPolice 2nd 3rd

    Provos, Niels

    proxy firewalls

    PS-MPC (Phalcon-Skism Mass-Produced Code Generator) 2nd

    PSD v(irus)

    pseudo-decryption loops

    PSMPC generators

    PT (partition table) entries

    changing 2nd

    PTE (page table entry)

    Python viruses 2nd


    • / 191