427 Botnet fm qxd

www.syngress.com
Botnet Detection: Tools and Techniques • Chapter 5
165
427_Botnet_05.qxd 1/9/07 9:59 AM Page 165

---

menting other elements of integrity management, is a technique called
heuristic analysis
.
T
IP
Integrity detection
is a term generally used as a near-synonym for
change detection
, though it might suggest more sophisticated
approaches. 
Integrity management
is a more generalized concept and
suggests a whole range of associated defensive techniques such as
sound change management, strict access control, careful backup sys-
tems, and patch management. Many of the tools described here can
be described as integrity management tools, even though they aren’t
considered change/integrity detection tools.
Heuristic analysis (in AV; spam management tools often use a similar
methodology, though) is a term for a rule-based scoring system applied to
code that doesn’t provide a definite match to known malware. Program
attributes that suggest possible malicious intent increase the score for that pro-
gram.The term derives from a Greek root meaning 
to discover
and has the
more general meaning of a 
rule of thumb
or an informed guess. Advanced
heuristics use a variety of inspection and emulation techniques to assess the
likelihood of a program’s being malicious, but there is a trade-off:The more
aggressive the heuristic, the higher the risk of false positives (FPs). For this
reason, commercial antivirus software often offers a choice of settings, from
no heuristics (detection based on exact or near-exact identification) to mod-
erate heuristics or advanced heuristics.
Antivirus vendors use other techniques to generalize detection. Generic
signatures, for instance, use the fact that malicious programs and variants have
a strong family resemblance—in fact, we actually talk about virus and bot
families in this context—to detect groups of variants rather than using a single
definition for each member of the group.This has an additional advantage:
There’s a good chance that a generic signature will also catch a brand-new
variant of a known family, even before that particular variant has been ana-
lyzed by the vendor.