首页
外语
计算机
考研
公务员
职业资格
财经
工程
司法
医学
专升本
自考
实用职业技能
登录
外语
Letting computer viruses loose on a quarantined computer and recording their pattern of activity could lead to a better way of s
Letting computer viruses loose on a quarantined computer and recording their pattern of activity could lead to a better way of s
admin
2009-06-24
65
问题
Letting computer viruses loose on a quarantined computer and recording their pattern of activity could lead to a better way of spotting them in the "wild".
A prototype system developed at the University of Michigan uses the "fingerprint" of virus activity to identify them more effectively than existing anti-virus software.
The designers of programs that damage, take over or steal data from computers—called malware—are locked in an arms race with companies that make anti-virus (AV) software to prevent and fix malware damage.
Conventional AV software looks for suspicious behavior and then tries to determine what’s causing it. It does this by looking for virus "signatures"—chunks of computer code from known viruses.
But identifying previously unknown malware is difficult, and keeping track of different variants of existing viruses makes it harder. For example, a virus called Agobot has split into more than 580 variants since its release in 2002.
In tests, Michael Bailey and colleagues at the University of Michigan, U.S., showed that five leading AV programs could identify only between 50 and 80 percent of a large sample of malware. And the programs struggled to agree on what they had found—the identifications often did not match.
Bailey and his team say their approach is superior and have used it to develop a prototype AV system that is significantly better at identifying viruses once they are detected.
The team set loose the malicious software on a quarantined computer, recording all the files and strings of instructions (processes) created and modified by the malware.
They then created software that uses a database of these "fingerprints" to identify malware. It can also define clusters of malware that operate in similar ways, and generate a kind of family tree showing how superficially different programs have similar modi operandi.
In tests on the same malware, the new software could identify at least 10 percent more of the sample than any of the other AV software. It also always correctly linked different pieces of malware that behave in the same way—the best AV program spotted only 68 percent of such doubles.
"What they’re doing here is quite viable", says Richard Overill, a researcher at Kings College London, UK. "In principle this should work very well at identifying different viruses, and grouping those that may appear different but work in the same way".
The new approach could reduce the number of updates needed for conventional AV systems, suggests Overill. "Instead of having separate patches for each virus, this could be more efficient and reduce the size of updates that must be downloaded".
Grant Malcom researches computer security at Liverpool University, U.K. He says that recording activities like files created and modified is a novel approach to the problem and that it would be interesting to see whether this approach to categorizing malware could work without giving false positives.
选项
A、There is competition between virus designers and AV companies.
B、The definition of "malware".
C、Malware designers are locked up by AV companies.
D、A metaphoric explanation of how the new AV software is developed.
答案
D
解析
转载请注明原文地址:https://kaotiyun.com/show/hbTd777K
本试题收录于:
公共英语五级笔试题库公共英语(PETS)分类
0
公共英语五级笔试
公共英语(PETS)
相关试题推荐
WhentoTakeMedicineIsImportantOurbodiesarewonderfullyskillfulatmaintainingbalance.Whenthetemperaturejumps,
Whereisthenapkinnormallyplacedduringthemeal?Whichofthefollowingshowsgoodtablemanners?
GoodTableMannersMannersplayanimportantpartinmakingafavorableimpressionatthedinnertable.Herearesomegenera
WhoisAndy?Theword“sullen”(paragraph3)couldbebestreplacedby
Whichofthefollowingdoesthefirstparagraphimply?WhichofthefollowingisNOTmentionedasathingthatagoodparentsh
SmokingSince1939,numerousstudieshavebeenconductedtodeterminewhethersmokingisahealthhazard.Thetrendoftheev
A.toloseyourhouseB.tomanageyouremployeesC.tokeepindependentD.tolendyoumoneyE.totaketheresponsibilityforitF.
NewU.S.PlanforDiseasePreventionUrgingAmericanstotakeresponsibilityfortheirhealth,HealthandHumanServicesSe
Howdidthestudyevaluateeveryparticipant’ssenseofresponsibility?Previousstudiessuggest______.
随机试题
患者男性,24岁,近半年来腹部不适,多次剧烈腹痛,空腹12小时抽血分离血浆呈奶样乳白色,经15000转/分离心30分钟后,发现血浆下层较透明,而表面为奶油层。血脂测定结果:TC:9.01mmol/L,TG:1.36mmol/L如结合痘状;家族史与血脂测
如图所示,箭头所指的解剖组织是
用来判断暴露危险因素是否与疾病有关联其关联程度大小的—种观察性研究方法是()
张老汉现年70岁,家住某市A县农村,因早年丧妻,一人抚养三个儿子张大、张二和张三长大成人,三个儿子结婚后并分别居住在该市B区、C区、D区。2001年8月以来,张老汉患上某种老年慢性病,需要长期治疗,然而三个儿子唯恐花费过高,竞拒绝为其进行治疗,把张老汉一人
由于雇主不能按规定的时间向承包商提供进入和占用现场的权利,导致承包商受到损失,则承包商可以要求( )。
金融机构开展资产管理业务的公募产品主要投资于()。Ⅰ.标准化债权类资产Ⅱ.上市交易的股票Ⅲ.未上市企业股权Ⅳ.商品及金融衍生品
德育过程是对学生知、情、意、行的培养和提高过程,其实施顺序是()
动物骨头都含有钙的成分,很难溶解于水,有人曾做过实验,用5公斤猪骨头加上5公斤水,在高压锅里熬10个小时,结果一碗骨头汤中的钙含量不过10毫克,不及一袋牛奶钙含量的1/20。骨头汤里还溶解有大量骨内脂肪,经常食用会引发其他健康问题。因此,喝骨头汤未必是治疗
路由选择协议是IP网络实用化的关键,它决定了数据包从“源”传送到“目的地”的路径:IP网络中最广泛使用的路由协议之一是(11)。能够实现路由选择功能的设备(12)。
在当前表中,查找第2个男同学的记录,应使用命令
最新回复
(
0
)