4.2Malware and unauthorized-access countermeasures

"Preventing all intrusions" can no longer be assumed. Given targeted attacks and zero-day exploits, a design philosophy of assuming intrusion will happen and deciding what to stop at each layer is essential. This section studies malware and unauthorized-access countermeasures from the perspective of a security officer deciding what to place at each layer of defense in depth and how to minimize damage if an intrusion does occur.

4.2.1Malware detection techniques

• Pattern matching (signature-based detection) compares files against known malware's characteristic byte sequences (signatures). It is highly accurate and fast against known threats, but has the fundamental limitation of being unable to detect unknown malware whose signature is not yet registered.
• The behavior method runs a program and monitors its actual runtime behavior—registry changes, suspicious communication—to judge maliciousness. The heuristic method estimates the likelihood of maliciousness statistically or by rule-of-thumb from a program's code structure or patterns. Both can potentially detect unknown malware without relying on signatures.
• Dynamic analysis observes behavior by actually running the sample (often inside a sandbox). Static analysis examines the code or binary structure without executing it. Dynamic analysis can capture behavior that only appears at runtime, but its effectiveness can diminish against malware that evades sandbox detection (behaving benignly once it detects an analysis environment).