tailieunhanh - Computer Viruses and Malware phần 8

Họ cũng có thể được xem như là một bảo vệ chống lại phần mềm chống virus sử dụng chẩn đoán tĩnh. 100 Phần này được dựa trên Rescorla [262] trừ khi có ghi chú khác. Để đơn giản, áp dụng cách giải quyết và nâng cấp mới, phiên bản phần mềm cố định cũng được coi là "vá" ở đây bởi vì họ tất cả đều có tác dụng tương tự ròng: sửa chữa các lỗ hổng | 152 COMPUTER VIRUSES AND MALWARE Machine 1 Machine 2 Machine 3 Machine 4 Machine 5 Machine 6 Machine 7 Machine 8 Machines Machine 10 Machine 1 Machine 2 Machine 3 Machine 4 Machine 5 47523 10 61 98 Time Machine 6 Machine 7 Machine 8 Machines Machine 10 Machine 1 Machine 2 Machine 3 Machine 4 Machine 5 47523 10 61 98 Machine 6 Machine 7 Machines Machines Machine 10 Figure . Permutation scanning 2 Speeding up initial spread. By providing a list of known targets slow propagation by trial-and-error is avoided and the worm s growth curve shifts to the left as a result. A variation on the hit-list scheme precompiles a list of all vulnerable machines on the Internet and sends it along with the worm in compressed form. Worms 153 Permutation scanning If a worm is able to tell whether or not a target candidate is already infected then other means of contention avoidance can be used. Permutation scanning is where instances of a worm share a common permutation of the IP address space a pseudo-random sequence over all 232 possible IP address values. Each new instance is given a position in the sequence at which to start infecting and the worm continues to work through the sequence from there. Figure has an example for a ten-value permutation. If a machine is encountered which is already infected then the worm picks a new spot in the sequence randomly. This gives the worm a simple mechanism for distributed coordination without any communication overhead between worm instances. Interestingly peer-to-peer networks for file sharing share the same need for low-overhead distributed This coordination mechanism can be used by the worm to heuristically detect saturation too. If a worm instance continually finds already-infected machines despite randomly resituating itself in the permutation sequence then it can serve as an indicator that most of the vulnerable machines have been infected. More generally a worm can mathematically model its own growth curve to .