?
Solved

lexical analysis and malware

Posted on 2009-03-31
2
Medium Priority
?
527 Views
Last Modified: 2013-11-22
Hello,

How can malware detection techniques can be related to lexical analysis ?

Thanks in advance for any info !
0
Comment
Question by:unknown_
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 6

Accepted Solution

by:
IKZ earned 2000 total points
ID: 24034911
Well just like every lexeme has a token associated with it to characterize it, so does a virus have a signature and it's "token" is a spot in the virus definition dictionary.  Signature based detection is the most common method that antivirus software uses to identify malware. This method is somewhat limited by the fact that it can only identify a limited amount of emerging threats, e.g. generic, or extremely broad, signatures.

For instance:
Lexeme: =    Token:  ASSIGN_OP
Lexeme: 5    Token:  NUMBER

Virus:  8 random character .dll file in system32 folder   Definition:  Vundo or Virtumonde

To the same effect, Tokenization is similar to the detection of viruses.
The first stage of lexical analysis is called the Scanner (just like in virus detection- it scans for certain things, like 8 random character .dll files in system32 folder like we talked about above.  Then the second stage in LA is called the evaluator.  Antivirus scanners do the same thing-- it finds data, usually broad, general or generic things, then evaluates or analyzes them and assigns them a value (virus or not).

Does this help at all?
0

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this blog we highlight approaches to managed security as a service.  We also look into ConnectWise’s value in aiding MSPs’ security management and indicate why critical alerting is a necessary integration.
The recent Petya-like ransomware attack served a big blow to hundreds of banks, corporations and government offices The Acronis blog takes a closer look at this damaging worm to see what’s behind it – and offers up tips on how you can safeguard your…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question