Detecting unknown computer viruses - A new approach

We give an overview of the tools to detect computer viruses without relying on "pattern files" that contain "signatures" of previously captured viruses. The system combines static code analysis with code simulation to identify malicious behaviors commonly found in computer viruses such as mass mailing, file infection, and registry overwrite. These prohibited behaviors are defined separately as security policies at the level of API library function calls in a state-transition like manner. The current tools target at Win32 binary viruses on Intel IA32 architectures and early experiments show that they can detect most email viruses that had spread in the wild in recent years.