<p>This Master’s Thesis within the area computer security concerns ”Computer viruses: The threat today and the expected future”. </p><p>Firstly, the definitions of computer virus and the related threats are presented; Secondly, current situation of computer viruses are discussed, the working and spreading mechanisms of computer viruses are reviewed in details, simplistic attitude of computer world in computer virus defence is analyzed; Thirdly, today’s influencing factors for near future computer virus epidemics are explained, then it further predicts new possible types of computer viruses in the near future; Furthermore, currently available anti-virus technologies are analyzed concerning both advantages and disadvantages; Finally, new promising trends in computer virus defence are explored in details.</p>

Computer viruses uses a few different techniques, with various intentions, toinfect files. However, what most of them have in common is that they wantto avoid detection by anti-malware software. To not get detected and stay unnoticed,virus creators have developed several methods for this. Anti-malwaresoftware is constantly trying to counter these methods of virus infections withtheir own detection-techniques. In this paper we have analyzed the differenttypes of viruses and their infection techniques, and tried to determined whichworks the best to avoid detection. In the experiments we have done we havesimulated executing the viruses at the same time as an anti-malware softwarewas running. Our conclusion is that metamorphic viruses uses the best methodsto stay unnoticed by anti-malware software’s detection techniques.

Denna literaturöversikt går igenom två olika system inom IT-säkerhet och hur de fungerar tillsammans med maskinlärningstekniker till en relativt ytlig nivå.Syftet med denna rapport är att kunna sammanfatta dessa system och se hur de kan hjälpa med en systemadministratörs uppgifter, hur det kan användas för automatisera och vad för positiva och negativa förändringar det kan ha på en infrastruktur.Maskinlärning kan vara ett kraftigt verktyg för systemadministratörer för att lätta på arbetsmängden som kan förekomma inom en organisation, vilket är också varför det är viktigt att diskutera när och var man ska utplacera en lösning. Den här studien ska diskutera användningen av maskinlärning och när och var det kan användas. / This literature review discusses two different systems within IT-security and how they work within machine learning to a relatively surface-level degree.The purpose of this paper is to be able to summarize these systems and see how they can help a system administrator’s assignments. how it can be used for automation and the positives and negatives.Machine learning can be a powerful tool for system administrators to alleviate the workload which can exist within an organization, which is why it is important to discuss when and where to deploy a solution.

L’allogreffe de cellules souches hématopoïétiques (CSH) est un des seuls traitements curatifs des hémopathies bénignes ou malignes et des déficits immunitaires primitifs. Cependant, les infections notamment virales ainsi que la réaction du greffon contre l’hôte comptent parmi les complications les plus fréquentes des allogreffes associées à une morbidité et une mortalité élevées. Les infections virales surviennent souvent en l’absence de reconstitution immunitaire spécifique dans un contexte d’immunosuppression liée à la GVHD elle-même ou à la prophylaxie ou au traitement de la GVHD. Les traitements médicamenteux anti-viraux préconisés présentent une efficacité inconstante dans ce contexte d’immunodéficience et ne sont pas dénués de toxicité. L’alternative thérapeutique prometteuse est l’immunothérapie adoptive cellulaire notamment celle qui consiste en l’injection de lymphocytes T spécifiques anti-viraux isolés par technique immunomagnétique (VSTs). Cependant, ces lymphocytes T peuvent être la cible des traitements immunosuppresseurs administrés pour la GVHD mais également par eux-mêmes être potentiellement la cause de la survenue ou de la réactivation d’une GVHD. Nous avons montré dans ce travail que l’efficacité des VSTs, qui repose sur leur expansion in vivo lors de la rencontre avec le virus circulant, est principalement permise par les sous-populations lymphocytaires les plus immatures, même si elles ne sont présentes qu’en faible proportion. Nous défendons dans ce travail le fait que l’efficacité des VST ainsi que leur persistance repose prioritairement sur la présence des sous-populations lymphocytaires T les plus immatures et ce quel que soit le degré de compatibilité HLA entre les VSTs et le receveur. De plus, leur sensibilité modérée aux corticoïdes, que nous avons étudiée in vitro, ne justifie pas la modulation de l’immunosuppression lors de l’injection des ADV-VSTs, comme observé in vivo dans le protocole clinique multicentrique de phase I/II que nous avons mené entre 2012 et 2015. En effet, ce protocole clinique ne rapporte aucune GVHD de novo après injection d’ADV-VSTs ; en revanche, la modulation de l’immunosuppression peut potentiellement être incriminée dans la réactivation de GVHD dans les semaines suivant l’injection des ADV-VSTs. La réalisation d’un essai comparatif de phase II permettra de prouver très clairement le rôle des VSTs dans la réactivation de GVHD. / Hematopoietic stem cell transplantation (HSCT) is one of the only curative treatments for benign or malignant hematological diseases and primary immune deficiencies. However, viral infections and graft-versus-host disease (GVHD) are among the most frequent complications after HSCT associated with high morbidity and mortality. Viral infections often occur in the absence of specific immune reconstitution in the context of immunosuppression related to GVHD itself or to the prophylaxis or treatment of GVHD. The recommended anti-viral drug treatments have an inconsistent efficacy in this context of immunodeficiency and are not devoid of toxicity. The promising therapeutic alternative is adoptive immunotherapy, in particular the infusion of specific anti-viral T lymphocytes isolated by immunomagnetic technique (VSTs). However, these T lymphocytes may be targeted by immunosuppressive treatments administered for GVHD, but also may be the cause of the onset or reactivation of GVHD. We have shown in this work that the efficacy of VSTs, which is based on their in vivo expansion when they encounter the circulating virus, is mainly allowed by the most immature lymphocyte subpopulations, even in a small proportion. We argue in this work that the efficacy of VSTs and their persistence is mainly based on the presence of the most immature T lymphocyte subpopulations and this regardless of the degree of HLA compatibility between the VSTs and the recipient. Moreover, their moderate sensitivity to corticosteroids, which we have studied in vitro, does not justify the modulation of immunosuppression at the time of infusion of ADV-VSTs, as observed in vivo in the multicenter phase I / II clinical trial we conducted between 2012 and 2015. Indeed, this clinical trial does not report any de novo GVHD after ADV-VSTs infusion. On the other hand, modulation of immunosuppression may potentially be incriminated in the reactivation of GVHD within weeks of ADV-VST infusion. A Phase II comparative trial will bring the evidence of efficacy and will clearly determine the role of VSTs in the reactivation of GVHD

Thesis (MBA (Business Management))--Stellenbosch University, 2008. / ENGLISH ABSTRACT: Soon after the development of the internet as a network structure connecting computers on a global scale, was the introduction of malicious computer code, which was disseminated through this network. Initially this code was the relegation of pranksters, but evolved quickly to be code causing destruction, intrusion and loss of privacy while on the internet. This code became known as the computer virus and was soon used by fraudsters to infiltrate networks to create deception and fraud for financial gain. It has become of paramount importance for users of the internet to protect themselves and their networks from these attacks, through various ingenious mechanisms of protection. The traditional mainstay for computer virus protection has been the software approach using counter code to protect against any malicious computer code. This protection has had limited success as the very nature of malicious code is constantly changing and evolving, making it sometimes an impossible task for internet users to be protected with the latest anti-virus software for protection. The author of this study introduces a managed anti-virus protection alternative which is delivered by a computer hardware device. This is a new technology and a full description is made of the role of this product as a new product development. The empirical research of this paper focuses around the test for a need for the product described to the point, but excluding commercialization. / AFRIKAANSE OPSOMMING: Kort na die ontwikkeling van die internet as 'n netwerkstruktuur wat rekenaars op 'n globale skaal verbind, was daar die bekendstelling van kwaadwillige rekenaarkodes wat reg deur die netwerk versprei het. Aanvanklik was die kode gemik op die verdrywing van poetsbakkers, maar het spoedig ontwikkel in kodeverdrywing, inmenging en verlies aan privaatheid op die internet. Hierdie kode het bekend geword as die rekenaarvirus, en is spoedig deur bedrieërs gebruik om netwerke te infiltreer om gebruikers te mislei en te bedrieg vir eie finansiële gewin. Dit het vir gebruikers van die internet van uiterste belang geword om hulle en hulle netwerkte teen hierdie aanvalle te beskerm, en wel deur middel van verskeie meganismes. Die bekendste bekermingsmatreël teen die virus is die aanwending van sagteware as teenkode. Hierdie bekermingsmetode het egter tot dusver beperkte sukses behaal, aangesien die aard van kwaadwilligheid voortdurend verander en ontwikkel, sodat dit soms onmoontlik is dat gebruikers deur die nuutste anti-virussagteware beskerm kan word. Die skrywer van hierdie verhandeling stel 'n werkbare, alternatiewe anti-virusbeskermer bekend wat deur rekenaar-hardewareplan daargestel is. Dit het nuwe tegnologie, en 'n volledige beskrywing word gegee van die rol van hierdie produk as 'n nuwe ontwikkeling. Die empiriese navorsing van die verhandeling fokus op die toets vir die noodsaaklikheid van so 'n produk, met die uisluiting van kommersialisering.

This Master’s Thesis within the area computer security concerns ”Computer viruses: The threat today and the expected future”. Firstly, the definitions of computer virus and the related threats are presented; Secondly, current situation of computer viruses are discussed, the working and spreading mechanisms of computer viruses are reviewed in details, simplistic attitude of computer world in computer virus defence is analyzed; Thirdly, today’s influencing factors for near future computer virus epidemics are explained, then it further predicts new possible types of computer viruses in the near future; Furthermore, currently available anti-virus technologies are analyzed concerning both advantages and disadvantages; Finally, new promising trends in computer virus defence are explored in details.

This paper will focus solely on the effectiveness of AV (antivirus) in detecting Metasploit payloads which have been encapsulated with different encapsulation modules. There seems to be a significant knowledge gap in the evaluation of commercial antivirus's software and their ability to detect malicious code and stop such code from being executed on IT systems. Therefore we would like to evaluate the capabilities of modern AV software with the use of penetration testing tools such as Metasploit. The research process is heavily reliant on a case study methodology as it can be argued that each payload generated reflects a case in itself. Firstly the payloads are generated and encapsulated through the self developed software, secondly they are uploaded to VirusTotal to be scanned with the use of their publicly available API, third the results are obtained from VirusTotal and stored locally. Lastly the results are filtered through with the software which in turn generates graphs of the results. These results will provide sufficient data in comparing encapsulation methods, payload detection rates, draw conclusions regarding which operating system may be most vulnerable as well as the overall state of modern AV software's capabilities in detecting malicious payloads. There are plenty of noteworthy conclusions to be drawn from the results, one of them being the most efficient encapsulation method powershell_base64 which had amongst the lowest detection rates in regards to the amounts of payloads it encoded, meaning that its encapsulation hid the malicious code from the AV at a higher degree than most the other encapsulation modules. The most noteworthy conclusion from the results gathered however is the encapsulation methods which obtained the absolute lowest detection rates, these were x86_nonalpha, x86_shikata_ga_nai, x86_xor_dynamic as well as payloads without any encoding at all, which had a few payloads reach among the lowest detection rates across the board (&lt;20%).

No description available.

傳統商學院論文所探討的競爭態勢多半聚焦於廠商間的競爭，著重組織對組織、集團對集團的互動過程，本研究提出競爭的另一種型態，描述由個體所組成的非正規群體(駭客)與組織集團(廠商)的競爭，以病毒與防毒軟體廠商的互動過程為例，透過歷史的描述呈現電腦病毒、防毒廠商、戰爭三個構面。 本研究以病毒為描述主體作為邪惡的反方角色，並且深入探討其背後的核心操控者：駭客們的動機與行為，之後將相對應的正方角色：防毒公司拉進來，詮釋病毒與防毒軟體的互動過程。最後，整理出在歷史的演進之下，病毒/防毒戰爭過程中的脈絡與攻防特性，並演譯歸納出病毒的五大創新特點：技術Deeper、影響範圍Bigger、傳播速度Faster、病毒行為Smarter、產業結構Robuster。 綜觀國內外商學院論文，尚無類似論述，其突破性貢獻有三：其一，本研究提出以病毒負效用的特性作為創新的論述，至今無人提出，雖可議卻也空前；其二，本研究突破過去討論病毒相關議題僅考量單項變數的限制，以全面性的系統觀點探討其特性；其三，此類議題的相關論文處理方式多半以量化、實作亦或次級資料整理為主，本研究則進行深入訪談的田野調查。 基於創新來自於邊陲的概念，本論文希望排除道德的限制，單純從特性上加以考量其創新，並非鼓勵或褒揚之意。希望提供企業以另一個層次的角度思考本文所提出之創新觀點，應用於研發管理、創新管理、行銷管理、策略管理等領域，興許能有不同的創新解決方案。 / Most papers from the traditional business school discuss the competitions among manufacturers, and focus on the interactions between organizations and between groups. However, in this paper, we propose another type of competition - the competition between the hacker (composed by the individuals or non-regular organization) and the manufacturer (organizations or groups). Here, we take the interaction between virus and anti-virus software manufacturers as example to describe the 3 dimensions among computer virus, anti-virus software manufactures and their contests. In this thesis, we take virus as the evil side and expect to dig out the motivation and behavior of the hackers, and then we take the anti-virus software manufactures as the counter side to discuss the interaction between virus and anti-virus software. Finally, we sum up the 5 innovative characteristics of the virus: the skill is deeper, the incidence is bigger, the spreading speed is faster, the virus behavior is smarter and the industrial structure is more robust. In this thesis, there are 3 unprecedented distributions: first, we propose the innovative concept by using the disutility characteristic of virus; second, we breakthrough the restriction that only taking the single parameter into consideration, and we take the total system viewpoints into consideration to discuss its characteristics; third, instead of quantification, experimentation, and sub-data collection, we do the research through the interview and the field work. In this thesis, we wish to eliminate morals constraints, just consider its innovative concept, and not mean to encourage or commend it. Furthermore, we expect to provide the enterprises another way to think about this new concept, and apply it in research and development management, innovation management, marketing management, strategy management, and so on. We believe that there will be some other different innovative solutions.

The object of the study is malware and methods for its detection. The subject of the study is machine learning algorithms and neural networks for classifying files into malicious and safe. The purpose of the work is to develop an antivirus solution based on neural networks. Relevance of the work: the acceleration of the digitalization process makes the issue of protecting confidential data critically important. Traditional methods of antivirus protection are ineffective against zero-day attacks; more intelligent solutions are needed. Research methods: literature review, comparative analysis of machine learning algorithms and models, experimental studies, supervised learning, model validation and testing, software development, iterative testing. Results of the work: the antivirus software "Arbiter v2.5" has been created, surpassing existing neural network solutions. High accuracy of threat detection, including zero-day attacks, has been experimentally proven. Scientific novelty lies in the application of neural network language models for anti-virus file analysis. The proposed approach demonstrates significant potential for improving the issue of cybersecurity and has prospects for further research. / Объект исследования – вредоносное ПО и методы его обнаружения. Предметом исследования являются алгоритмы машинного обучения и нейронные сети для классификации файлов на вредоносные и безопасные. Цель работы – разработка антивирусного решения на основе нейронных сетей. Актуальность работы: ускорение процесса цифровизации делает вопрос защиты конфиденциальных данных критически важным. Традиционные методы антивирусной защиты малоэффективны против атак «нулевого дня», необходимы более интеллектуальные решения. Методы исследования: литературный обзор, сравнительный анализ алгоритмов и моделей машинного обучения, экспериментальные исследования, обучение с учителем, валидация и тестирование модели, разработка ПО, итерационное тестирование. Результаты работы: создано антивирусное ПО «Arbiter v2.5», превосходящее существующие нейросетевые решения. Экспериментально доказана высокая точность обнаружения угроз, включая атаки «нулевого дня». Научная новизна заключается в применении нейросетевых языковых моделей для антивирусного анализа файлов. Предложенный подход демонстрирует значительный потенциал для улучшения вопроса кибербезопасности и имеет перспективы для дальнейших исследований.