Infected File Detection through Group File Characteristics
In-Seog Seo, In-Jung Kim, Jang-Hong Yoon, Jae‐Cheol Ryou · 2011
Several PC has same file structure and characteristics. We may guess that each file in group PC has same characteristics. Malicious code attacks windows system file and modify it to activate attacker's code. The we can see the modified window system file. So if malicious code is exist in a PC, then we can find modified system file. So we can determine modification of system file through comparison with other group file characteristics. This paper gathers group file characteristics and analyze the correctness of the proposal.