Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Improve] cxx/VirusAnalysis.cxx: per-computer randomness of signatures/heuristics/sandboxes #12

Open
SwuduSusuwu opened this issue Jul 3, 2024 · 0 comments
Labels
good first issue Good for newcomers improve New feature or request

Comments

@SwuduSusuwu
Copy link
Owner

SwuduSusuwu commented Jul 3, 2024

Background: produceAbortListSignatures (cxx/VirusAnalysis.cxx#L96) uses listProduceUniqueSubstr (cxx/ClassResultList.hxx#L76) to produce the shortest signature of each infection which does not overlap with honest executables (does not give false positives).
Rationale: To mimic human immune responses, can do per-compute randomness as: use std::random to choose a few signatures, remove some of the first/last of those signatures to allow false positives (plus mo re detections of new infections which would otherwise have false negatives.) This requires a new bool (such as ResultListSignature.triggersFalsePositives) which causes signatureAnalysis to not return virusAnalysisAbort but rather return virusAnalysisRequiresReview (asks the user what to do.)
The randomness can also include:
staticAnalysis which triggers false positives (plus ask the user what to do);
random versions of the chroot for sandboxAnalysis.

Lots to do. If you want this: respond that you wish more resources go to this, or contribute.

@SwuduSusuwu SwuduSusuwu added improve New feature or request good first issue Good for newcomers labels Jul 4, 2024
@SwuduSusuwu SwuduSusuwu changed the title Todo: per-computer randomness of signatures/heuristics/sandboxes [Improve] cxx/VirusAnalysis.cxx: per-computer randomness of signatures/heuristics/sandboxes Nov 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Good for newcomers improve New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant