Shared resources, such as the Internet, have created a highly interconnected cyber-infrastructure. Critical infrastructures in domains such as medical, power, telecommunications, and finance are highly dependent on information systems. These two factors have exposed our critical infrastructures to malicious attacks and accidental failures. Many malicious attacks are achieved by malicious code or malware, such as viruses and worms. Given the deleterious affects of malware on our cyber infrastructure, identifying malicious programs is an important goal. Unfortunately, malware detectors have not kept pace with the evasion techniques commonly used by hackers, i.e., the good guys are falling behind in the arms race.

Malware Detection captures the state of the art research in the area of malicious code detection, prevention and mitigation.

CUSTOMER REVIEWS (Average Customer Rating: 4.0 based on 1 review)

new ideas, but expensive

The methods in this book give a view of the state of the art in fighting malware. Written at a strong technical level for people wanting to detect viruses, worms, Trojans and other net dangers. The authors draw together ideas from a wide variety of sources.

One aspect is that the simple idea of virus signatures is under increasing assault from polymorphic viruses that make room within their bodies to insert random bit sequences. Which means that behavioural detection schemes now become more important. In general, these can be much harder to do, than simply finding a signature of a file and then comparing it against a blacklist. This can be done without running the file. A very safe approach. But some behavioural methods might involve having to run the file in a sandbox. Which is more elaborate, and might have the possibility that the binary might do unwanted things or even break out of a badly coded sandbox.

You can consider the text as a good sequel to books that have already been out for a few years, like "Malware: Fighting Malicious Code" by Skoudis and Zeltser, or "Counter Hack Reloaded" by Skoudis and Liston. One obstacle might be the list price of $139. Unfortunately, this is typical of the publisher's offerings, which have a specialised and limited audience. Still, the price can be reasonable, if it exposes you to just one new idea that you would not otherwise have encountered.
April 08, 2007

SIMILAR PRODUCTS

Botnet Detection: Countering the Largest Security Threat (Advances in Information Security)
by Wenke Lee, Cliff Wang, David Dagon

The Art of Computer Virus Research and Defense (Symantec Press)
by Peter Szor

Virtual Honeypots: From Botnet Tracking to Intrusion Detection
by Niels Provos, Thorsten Holz

Reversing: Secrets of Reverse Engineering
by Eldad Eilam

Rootkits: Subverting the Windows Kernel (Addison-Wesley Software Security Series)
by Greg Hoglund, Jamie Butler