[Improve] cxx/VirusAnalysis.cxx
: per-computer randomness of signatures/heuristics/sandboxes
#12
Labels
cxx/VirusAnalysis.cxx
: per-computer randomness of signatures/heuristics/sandboxes
#12
Background:
produceAbortListSignatures
(cxx/VirusAnalysis.cxx#L96) useslistProduceUniqueSubstr
(cxx/ClassResultList.hxx#L76) to produce the shortest signature of each infection which does not overlap with honest executables (does not give false positives).Rationale: To mimic human immune responses, can do per-compute randomness as: use std::random to choose a few signatures, remove some of the first/last of those signatures to allow false positives (plus mo re detections of new infections which would otherwise have false negatives.) This requires a new
bool
(such asResultListSignature.triggersFalsePositives
) which causessignatureAnalysis
to notreturn virusAnalysisAbort
but ratherreturn virusAnalysisRequiresReview
(asks the user what to do.)The randomness can also include:
staticAnalysis
which triggers false positives (plus ask the user what to do);random versions of the
chroot
forsandboxAnalysis
.Lots to do. If you want this: respond that you wish more resources go to this, or contribute.
The text was updated successfully, but these errors were encountered: