🚀 go-pugleaf

On 06 Jan 93, bontchev said:

> There are already two polymorphic engines available (MtE and TPE) and
> we are going to see more and more polymorphic viruses in the future.
> An interesting question arises - how to determine how polymorphic a
> virus is? How to determine which of two viruses is "more polymorphic"?
> In other words - how to measure polymorphism in an objective way?

I think that the first thing that needs to be done is to separate the
'polymorphism' from the 'encryption'.  In your example code, that
would not be a polymorphic virus (rating 0), but an encrypting virus
(rating 1).

> Unfortunately, this is not good enough. First, what to do with viruses
> that use a limited set of decryptors, one of which is selected
> randomly (Whale). Such viruses are obviously more polymorphic than
> Cascade. But are they more or less polymorphic than Suomi? They can be
> detected by a set of non-wildcard strings...

By giving different ratings for encryption and polymorphism, this
problem would not be as big.  Also, a lesson could be taken from
fractal geometry.  Assign (whale) type viruses ratings between
numbers (1.3 for example).

> Second, what about Bad Boy? It consists of 9 segments of code, 8 of
> which can appear in any order. This gives 8! = 40,320 variants. But
> the virus is even not encrypted, so it can be detected with a simple
> (non-wildcard) scan string...

Bad Boy would have an encryption rating of 0, and a polymorphism
rating of 1 (or whatever.  I don't think the number of variants is
the only factor to be considered in the polymorphic rating.  As you
have shown, even a small number of segments can lead to a large
number of variants).

- ---
Ron Whittle
cscrdw%curie@epavax.rtpnc.epa.gov