<p>This Master’s Thesis within the area computer security concerns ”Computer viruses: The threat today and the expected future”. </p><p>Firstly, the definitions of computer virus and the related threats are presented; Secondly, current situation of computer viruses are discussed, the working and spreading mechanisms of computer viruses are reviewed in details, simplistic attitude of computer world in computer virus defence is analyzed; Thirdly, today’s influencing factors for near future computer virus epidemics are explained, then it further predicts new possible types of computer viruses in the near future; Furthermore, currently available anti-virus technologies are analyzed concerning both advantages and disadvantages; Finally, new promising trends in computer virus defence are explored in details.</p>

Computer viruses uses a few different techniques, with various intentions, toinfect files. However, what most of them have in common is that they wantto avoid detection by anti-malware software. To not get detected and stay unnoticed,virus creators have developed several methods for this. Anti-malwaresoftware is constantly trying to counter these methods of virus infections withtheir own detection-techniques. In this paper we have analyzed the differenttypes of viruses and their infection techniques, and tried to determined whichworks the best to avoid detection. In the experiments we have done we havesimulated executing the viruses at the same time as an anti-malware softwarewas running. Our conclusion is that metamorphic viruses uses the best methodsto stay unnoticed by anti-malware software’s detection techniques.

Denna literaturöversikt går igenom två olika system inom IT-säkerhet och hur de fungerar tillsammans med maskinlärningstekniker till en relativt ytlig nivå.Syftet med denna rapport är att kunna sammanfatta dessa system och se hur de kan hjälpa med en systemadministratörs uppgifter, hur det kan användas för automatisera och vad för positiva och negativa förändringar det kan ha på en infrastruktur.Maskinlärning kan vara ett kraftigt verktyg för systemadministratörer för att lätta på arbetsmängden som kan förekomma inom en organisation, vilket är också varför det är viktigt att diskutera när och var man ska utplacera en lösning. Den här studien ska diskutera användningen av maskinlärning och när och var det kan användas. / This literature review discusses two different systems within IT-security and how they work within machine learning to a relatively surface-level degree.The purpose of this paper is to be able to summarize these systems and see how they can help a system administrator’s assignments. how it can be used for automation and the positives and negatives.Machine learning can be a powerful tool for system administrators to alleviate the workload which can exist within an organization, which is why it is important to discuss when and where to deploy a solution.

L’allogreffe de cellules souches hématopoïétiques (CSH) est un des seuls traitements curatifs des hémopathies bénignes ou malignes et des déficits immunitaires primitifs. Cependant, les infections notamment virales ainsi que la réaction du greffon contre l’hôte comptent parmi les complications les plus fréquentes des allogreffes associées à une morbidité et une mortalité élevées. Les infections virales surviennent souvent en l’absence de reconstitution immunitaire spécifique dans un contexte d’immunosuppression liée à la GVHD elle-même ou à la prophylaxie ou au traitement de la GVHD. Les traitements médicamenteux anti-viraux préconisés présentent une efficacité inconstante dans ce contexte d’immunodéficience et ne sont pas dénués de toxicité. L’alternative thérapeutique prometteuse est l’immunothérapie adoptive cellulaire notamment celle qui consiste en l’injection de lymphocytes T spécifiques anti-viraux isolés par technique immunomagnétique (VSTs). Cependant, ces lymphocytes T peuvent être la cible des traitements immunosuppresseurs administrés pour la GVHD mais également par eux-mêmes être potentiellement la cause de la survenue ou de la réactivation d’une GVHD. Nous avons montré dans ce travail que l’efficacité des VSTs, qui repose sur leur expansion in vivo lors de la rencontre avec le virus circulant, est principalement permise par les sous-populations lymphocytaires les plus immatures, même si elles ne sont présentes qu’en faible proportion. Nous défendons dans ce travail le fait que l’efficacité des VST ainsi que leur persistance repose prioritairement sur la présence des sous-populations lymphocytaires T les plus immatures et ce quel que soit le degré de compatibilité HLA entre les VSTs et le receveur. De plus, leur sensibilité modérée aux corticoïdes, que nous avons étudiée in vitro, ne justifie pas la modulation de l’immunosuppression lors de l’injection des ADV-VSTs, comme observé in vivo dans le protocole clinique multicentrique de phase I/II que nous avons mené entre 2012 et 2015. En effet, ce protocole clinique ne rapporte aucune GVHD de novo après injection d’ADV-VSTs ; en revanche, la modulation de l’immunosuppression peut potentiellement être incriminée dans la réactivation de GVHD dans les semaines suivant l’injection des ADV-VSTs. La réalisation d’un essai comparatif de phase II permettra de prouver très clairement le rôle des VSTs dans la réactivation de GVHD. / Hematopoietic stem cell transplantation (HSCT) is one of the only curative treatments for benign or malignant hematological diseases and primary immune deficiencies. However, viral infections and graft-versus-host disease (GVHD) are among the most frequent complications after HSCT associated with high morbidity and mortality. Viral infections often occur in the absence of specific immune reconstitution in the context of immunosuppression related to GVHD itself or to the prophylaxis or treatment of GVHD. The recommended anti-viral drug treatments have an inconsistent efficacy in this context of immunodeficiency and are not devoid of toxicity. The promising therapeutic alternative is adoptive immunotherapy, in particular the infusion of specific anti-viral T lymphocytes isolated by immunomagnetic technique (VSTs). However, these T lymphocytes may be targeted by immunosuppressive treatments administered for GVHD, but also may be the cause of the onset or reactivation of GVHD. We have shown in this work that the efficacy of VSTs, which is based on their in vivo expansion when they encounter the circulating virus, is mainly allowed by the most immature lymphocyte subpopulations, even in a small proportion. We argue in this work that the efficacy of VSTs and their persistence is mainly based on the presence of the most immature T lymphocyte subpopulations and this regardless of the degree of HLA compatibility between the VSTs and the recipient. Moreover, their moderate sensitivity to corticosteroids, which we have studied in vitro, does not justify the modulation of immunosuppression at the time of infusion of ADV-VSTs, as observed in vivo in the multicenter phase I / II clinical trial we conducted between 2012 and 2015. Indeed, this clinical trial does not report any de novo GVHD after ADV-VSTs infusion. On the other hand, modulation of immunosuppression may potentially be incriminated in the reactivation of GVHD within weeks of ADV-VST infusion. A Phase II comparative trial will bring the evidence of efficacy and will clearly determine the role of VSTs in the reactivation of GVHD

Thesis (MBA (Business Management))--Stellenbosch University, 2008. / ENGLISH ABSTRACT: Soon after the development of the internet as a network structure connecting computers on a global scale, was the introduction of malicious computer code, which was disseminated through this network. Initially this code was the relegation of pranksters, but evolved quickly to be code causing destruction, intrusion and loss of privacy while on the internet. This code became known as the computer virus and was soon used by fraudsters to infiltrate networks to create deception and fraud for financial gain. It has become of paramount importance for users of the internet to protect themselves and their networks from these attacks, through various ingenious mechanisms of protection. The traditional mainstay for computer virus protection has been the software approach using counter code to protect against any malicious computer code. This protection has had limited success as the very nature of malicious code is constantly changing and evolving, making it sometimes an impossible task for internet users to be protected with the latest anti-virus software for protection. The author of this study introduces a managed anti-virus protection alternative which is delivered by a computer hardware device. This is a new technology and a full description is made of the role of this product as a new product development. The empirical research of this paper focuses around the test for a need for the product described to the point, but excluding commercialization. / AFRIKAANSE OPSOMMING: Kort na die ontwikkeling van die internet as 'n netwerkstruktuur wat rekenaars op 'n globale skaal verbind, was daar die bekendstelling van kwaadwillige rekenaarkodes wat reg deur die netwerk versprei het. Aanvanklik was die kode gemik op die verdrywing van poetsbakkers, maar het spoedig ontwikkel in kodeverdrywing, inmenging en verlies aan privaatheid op die internet. Hierdie kode het bekend geword as die rekenaarvirus, en is spoedig deur bedrieërs gebruik om netwerke te infiltreer om gebruikers te mislei en te bedrieg vir eie finansiële gewin. Dit het vir gebruikers van die internet van uiterste belang geword om hulle en hulle netwerkte teen hierdie aanvalle te beskerm, en wel deur middel van verskeie meganismes. Die bekendste bekermingsmatreël teen die virus is die aanwending van sagteware as teenkode. Hierdie bekermingsmetode het egter tot dusver beperkte sukses behaal, aangesien die aard van kwaadwilligheid voortdurend verander en ontwikkel, sodat dit soms onmoontlik is dat gebruikers deur die nuutste anti-virussagteware beskerm kan word. Die skrywer van hierdie verhandeling stel 'n werkbare, alternatiewe anti-virusbeskermer bekend wat deur rekenaar-hardewareplan daargestel is. Dit het nuwe tegnologie, en 'n volledige beskrywing word gegee van die rol van hierdie produk as 'n nuwe ontwikkeling. Die empiriese navorsing van die verhandeling fokus op die toets vir die noodsaaklikheid van so 'n produk, met die uisluiting van kommersialisering.

This Master’s Thesis within the area computer security concerns ”Computer viruses: The threat today and the expected future”. Firstly, the definitions of computer virus and the related threats are presented; Secondly, current situation of computer viruses are discussed, the working and spreading mechanisms of computer viruses are reviewed in details, simplistic attitude of computer world in computer virus defence is analyzed; Thirdly, today’s influencing factors for near future computer virus epidemics are explained, then it further predicts new possible types of computer viruses in the near future; Furthermore, currently available anti-virus technologies are analyzed concerning both advantages and disadvantages; Finally, new promising trends in computer virus defence are explored in details.

This paper will focus solely on the effectiveness of AV (antivirus) in detecting Metasploit payloads which have been encapsulated with different encapsulation modules. There seems to be a significant knowledge gap in the evaluation of commercial antivirus's software and their ability to detect malicious code and stop such code from being executed on IT systems. Therefore we would like to evaluate the capabilities of modern AV software with the use of penetration testing tools such as Metasploit. The research process is heavily reliant on a case study methodology as it can be argued that each payload generated reflects a case in itself. Firstly the payloads are generated and encapsulated through the self developed software, secondly they are uploaded to VirusTotal to be scanned with the use of their publicly available API, third the results are obtained from VirusTotal and stored locally. Lastly the results are filtered through with the software which in turn generates graphs of the results. These results will provide sufficient data in comparing encapsulation methods, payload detection rates, draw conclusions regarding which operating system may be most vulnerable as well as the overall state of modern AV software's capabilities in detecting malicious payloads. There are plenty of noteworthy conclusions to be drawn from the results, one of them being the most efficient encapsulation method powershell_base64 which had amongst the lowest detection rates in regards to the amounts of payloads it encoded, meaning that its encapsulation hid the malicious code from the AV at a higher degree than most the other encapsulation modules. The most noteworthy conclusion from the results gathered however is the encapsulation methods which obtained the absolute lowest detection rates, these were x86_nonalpha, x86_shikata_ga_nai, x86_xor_dynamic as well as payloads without any encoding at all, which had a few payloads reach among the lowest detection rates across the board (&lt;20%).

No description available.

傳統商學院論文所探討的競爭態勢多半聚焦於廠商間的競爭，著重組織對組織、集團對集團的互動過程，本研究提出競爭的另一種型態，描述由個體所組成的非正規群體(駭客)與組織集團(廠商)的競爭，以病毒與防毒軟體廠商的互動過程為例，透過歷史的描述呈現電腦病毒、防毒廠商、戰爭三個構面。 本研究以病毒為描述主體作為邪惡的反方角色，並且深入探討其背後的核心操控者：駭客們的動機與行為，之後將相對應的正方角色：防毒公司拉進來，詮釋病毒與防毒軟體的互動過程。最後，整理出在歷史的演進之下，病毒/防毒戰爭過程中的脈絡與攻防特性，並演譯歸納出病毒的五大創新特點：技術Deeper、影響範圍Bigger、傳播速度Faster、病毒行為Smarter、產業結構Robuster。 綜觀國內外商學院論文，尚無類似論述，其突破性貢獻有三：其一，本研究提出以病毒負效用的特性作為創新的論述，至今無人提出，雖可議卻也空前；其二，本研究突破過去討論病毒相關議題僅考量單項變數的限制，以全面性的系統觀點探討其特性；其三，此類議題的相關論文處理方式多半以量化、實作亦或次級資料整理為主，本研究則進行深入訪談的田野調查。 基於創新來自於邊陲的概念，本論文希望排除道德的限制，單純從特性上加以考量其創新，並非鼓勵或褒揚之意。希望提供企業以另一個層次的角度思考本文所提出之創新觀點，應用於研發管理、創新管理、行銷管理、策略管理等領域，興許能有不同的創新解決方案。 / Most papers from the traditional business school discuss the competitions among manufacturers, and focus on the interactions between organizations and between groups. However, in this paper, we propose another type of competition - the competition between the hacker (composed by the individuals or non-regular organization) and the manufacturer (organizations or groups). Here, we take the interaction between virus and anti-virus software manufacturers as example to describe the 3 dimensions among computer virus, anti-virus software manufactures and their contests. In this thesis, we take virus as the evil side and expect to dig out the motivation and behavior of the hackers, and then we take the anti-virus software manufactures as the counter side to discuss the interaction between virus and anti-virus software. Finally, we sum up the 5 innovative characteristics of the virus: the skill is deeper, the incidence is bigger, the spreading speed is faster, the virus behavior is smarter and the industrial structure is more robust. In this thesis, there are 3 unprecedented distributions: first, we propose the innovative concept by using the disutility characteristic of virus; second, we breakthrough the restriction that only taking the single parameter into consideration, and we take the total system viewpoints into consideration to discuss its characteristics; third, instead of quantification, experimentation, and sub-data collection, we do the research through the interview and the field work. In this thesis, we wish to eliminate morals constraints, just consider its innovative concept, and not mean to encourage or commend it. Furthermore, we expect to provide the enterprises another way to think about this new concept, and apply it in research and development management, innovation management, marketing management, strategy management, and so on. We believe that there will be some other different innovative solutions.

電腦病毒的演化瞬息萬變，特別是近年來，駭客在有利可圖的動機驅使下，逐漸形成了專業分工的產銷供應鏈，讓病毒的演化速度和變種數量以指數型成長。攻擊事件數量不斷竄升，資訊安全市場理應增加不少機會，但多數防毒廠商經常對這樣的市場機會望洋興嘆，每年花費數億金額，動員研發團隊提出新產品、新版本、新服務，使用者卻始終興趣缺缺。供需兩方認知差異讓防毒軟體廠商面臨龐大開發費用的損失，也讓企業持續存在於不定時資安風險的恐懼之中。 資安軟體公司在產品研發前，做足使用者需求蒐集流程工作，依照使用者描述所進行開發的產品，為什麼卻不是客戶需要的？本研究以質性研究法觀察國內一家電腦防毒廠商的新產品開發過程，更以為期一年的行動研究方式參與該公司使用者洞見計畫（Customer insight program），結合跨部門團隊的智慧和力量，以雲端運算的資安機會為主題進行客戶觀察和新產品構思。 經過一年的行動研究蒐證，本研究指出使用者導向設計的迷思，並強調瞭解工作脈絡對於系統性產品創新的重要性。由於系統性產品複雜程度較高，使用處於分工較細的系統運作流程之下，往往不自覺工作特殊之處，也難以確切表達總體需求。本研究的分析方式則透過使用者工作脈絡，即以客戶的商業模式和雲端運用的特殊情境，其次定義使用者於脈絡中獨特的痛點，進而找到創新機會。 使用者雖然是創新的來源，但是本研究發現，使用者不一定能知道自己的需求，唯有瞭解他們的工作實務，瞭解使用者在特定工作情境的痛點，才能化痛點為創新的亮點。研究貢獻上，補強現行使用者研究的三大方向，分別是使用者假設的不同、產品面設計的不同與創新來源不同。實務貢獻上，本研究提供複雜度較高的系統產品廠商在使用者導向設計流程之建議，以及企業中各部門如何透過使用者創新設計思維發揮價值所在。 / The rate of rapid evolution in computer virus results in an increase of computer crime and business attack incidents. Opportunities in the information security market began to grow and expected to exceed $125 billion USD by 2015, according to a new report by Global Industry Analysts. In this situation, anti-virus company tried everything they can to launch high-technology, fancy, and more powerful product every year. But they found customer is always lack of interest in their new products. This not only makes the loss on large investment in software development for anti-virus company, and also makes enterprise customers continuously at the risk of data stolen and computer virus attacks. By asking users what they want and trying really hard to listen to them before the development, however the product still hasn』t meet the customer needs? This research is based on qualitative method and action research project to investigate an anti-virus company』s product development process and customer insight programs. The one year project was cooperated with company internal cross-functional team and focused on 『Protecting the cloud』 topic. There are three cases was selected in the final. In order to know the user』s working context in the high-complexity information security product system. The analysis structure in three cases used four steps to find out. First of all, identify the enterprise user』s business model. Secondly, observe their local knowledge in cloud computing usage. Thirdly, clarify the organization's unique pain points. The last but not the least, find the potential security opportunities for innovation. While user becomes a significant source of innovation, the study shows that users don』t necessarily know their own needs. Only to understand customer』s work practices, pain points under specific working situations, and use design thinking to make the pain points to transform into fit customer needs. The research emphasized the importance of local context in innovation theory and reinforced the inadequacy part of the lead user theory. Key words: User-centric innovation, Product innovation, Service innovation, Cloud computing, Anti-virus software, Qualitative research, Action research