Path: softp!relay1!csoft!kiae!demos!fuug!mcsun!uunet!spool.mu.edu!howland.reston.ans.net!zaphod.mps.ohio-state.edu!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: CSCRDW%CURIE@vaxtm1.rtpnc.epa.gov (Ron Whittle)
Newsgroups: comp.virus
Subject: Re: How to measure polymorphism
Message-ID: <0006.9301121242.AA22066@barnabas.cert.org>
Date: 7 Jan 93 19:26:09 GMT
Sender: virus-l@lehigh.edu
Lines: 38
Approved: news@netnews.cc.lehigh.edu

On 06 Jan 93, bontchev said:

> There are already two polymorphic engines available (MtE and TPE) and
> we are going to see more and more polymorphic viruses in the future.
> An interesting question arises - how to determine how polymorphic a
> virus is? How to determine which of two viruses is "more polymorphic"?
> In other words - how to measure polymorphism in an objective way?

I think that the first thing that needs to be done is to separate the
'polymorphism' from the 'encryption'.  In your example code, that
would not be a polymorphic virus (rating 0), but an encrypting virus
(rating 1).

> Unfortunately, this is not good enough. First, what to do with viruses
> that use a limited set of decryptors, one of which is selected
> randomly (Whale). Such viruses are obviously more polymorphic than
> Cascade. But are they more or less polymorphic than Suomi? They can be
> detected by a set of non-wildcard strings...

By giving different ratings for encryption and polymorphism, this
problem would not be as big.  Also, a lesson could be taken from
fractal geometry.  Assign (whale) type viruses ratings between
numbers (1.3 for example).

> Second, what about Bad Boy? It consists of 9 segments of code, 8 of
> which can appear in any order. This gives 8! = 40,320 variants. But
> the virus is even not encrypted, so it can be detected with a simple
> (non-wildcard) scan string...

Bad Boy would have an encryption rating of 0, and a polymorphism
rating of 1 (or whatever.  I don't think the number of variants is
the only factor to be considered in the polymorphic rating.  As you
have shown, even a small number of segments can lead to a large
number of variants).

- ---
Ron Whittle
cscrdw%curie@epavax.rtpnc.epa.gov



