Computer “virus” identification by neural networks

Abstract

Computer viruses are more and more numerous: around 400 in the year 1990 and this number is estimated to reach 1,000 for 1994-95. Users are not experts and need help in identifying the virus and carrying out the most appropriate cure in case of attack. Knowledge of viruses is necessary but public information offered by virus database or catalogs gives a powerful advantage to virus makers. On the other hand, not enough or no information to users is also a problem because then they use the product they have which does not necessarily provide the appropriate solution in case of virus attack. We propose an alternative solution to the dilemma found in a neural network , an artificial intelligence connectionist model which is fault tolerant, self adaptative to learn automatically, retaining experience to solve the problem of virus identification regarding fuzzy information on concerns and effects. Principles of the formal neuron and the neural network using hidden nodes is examined as well as the theoretical and practical apects of the gradient back propagation algorithm. An implementation of the algorithm is applied to virus identification with data referring to virus concerns and their obvious effects. First results have shown a correct identification of viruses while using fuzzy knowledge of end users introducing uncertaincy on answers or, even, forcing erroneous data. Such a system can be employed by ordinary users, system or computer security managers, as well as consultants as a complementary tool for virus warfare. Further work needs to be conducted to validate methodologically such an approach and to optimize input data coding, the choice for parameters and the learning strategy.