Avishai Wool, a computer scientist at Tel Aviv University in Israel, aims to put the squeeze on malicious software with a program that models the expected behavior of legitimate programs and immediately halts anything that veers into unexpected territory.
— Bryn Nelson"; Tech_Frontiers_Korset080929[i++] = new Array("","Damage control","","","","", "", "", "", "", "", "", "", "273", "364", "", "", "", "", ""); Tech_Frontiers_Korset080929[i-1].body = "
Imagine a conveyor belt churning out a steady stream of colored cogs. If a dastardly villain throws a wrench into the machine, the sequence of cogs could change visibly — say from red-blue-blue to red-green-blue. Instead of trying to hunt down a potential saboteur, the Korset anti-malware program is like a conveyor belt operator who sees the new sequence, says, “That can’t be right” and promptly turns off the machine before it can be damaged."; Tech_Frontiers_Korset080929[i++] = new Array("","System calls","","","","", "", "", "", "", "", "", "", "273", "367", "", "", "", "", ""); Tech_Frontiers_Korset080929[i-1].body = "
Korset’s approach is based on a simplified model of every legitimate action a program could ever take. The simplification is based on regular requests from the underlying operating system, known as system calls. Every program has a fixed repertoire of these calls. If a system call sequence always begins with request numbers 1, 17 or 53, for example, then one beginning with 492 would be dead giveaway that the program has a bug or is being attacked."; Tech_Frontiers_Korset080929[i++] = new Array("","Anti-malware programs","","","","", "", "", "", "", "", "", "", "273", "364", "", "", "", "", ""); Tech_Frontiers_Korset080929[i-1].body = "
Unlike Korset, anti-malware programs based on statistical models try to sample what computers do under “normal” circumstances. But if even a small number of legitimate functions are left unsampled, eventually the statistically informed security force could kill a program it shouldn’t. Other intrusion detection systems patrol a computer looking for suspicious traffic patterns. In order to stop the attack, though, the detection system must find and identify the threat, leaving an inevitable time delay from the malware’s debut until its deactivation."; Tech_Frontiers_Korset080929[i++] = new Array("","An 'army of zombies'","","","","", "", "", "", "", "", "", "", "237", "423", "", "", "", "", ""); Tech_Frontiers_Korset080929[i-1].body = "
Anti-malware programs face a menagerie of malicious software. One type overwhelms programs that accept input (like a search window) with thousands of random characters that overflow from the allotted space and override the program’s code. Another attack uses as its input improper characters such as quotation marks, parentheses or semicolons — characters used by the program’s code to indicate important functions, like the end of a command. The trickery can throw the program completely out of whack. And a third uses malware to infiltrate thousands of computers and then direct the digital hordes to attack Web servers — a tactic often describes as marshaling an “army of zombies.” "; // END editorial data