Nó sẽ được tốt đẹp để trình bày một phân loại tư duy thông minh của phần mềm độc hại, cho thấy rõ ràng từng loại phần mềm độc hại liên quan đến tất cả các loại khác. Tuy nhiên, một nguyên tắc phân loại sẽ cung cấp cho các ấn tượng kỳ lạ và hoàn toàn không chính xác rằng | Chapter 2 DEFINITIONS AND TIMELINE It would be nice to present a clever taxonomy of malicious software one that clearly shows how each type of malware relates to every other type. However a taxonomy would give the quaint and totally incorrect impression that there is a scientific basis for the classification of malware. In fact there is no universally-accepted definition of terms like virus and worm much less an agreed-upon taxonomy even though there have been occasional attempts to impose mathematical formalisms onto Instead of trying to pin down these terms precisely the common characteristics each type of malware typically has are listed. Malware Types Malware can be roughly broken down into types according to the malware s method of operation. Anti- virus software despite its name is able to detect all of these types of malware. There are three characteristics associated with these malware types. 1 Self-replicating malware actively attempts to propagate by creating new copies or instances of itself. Malware may also be propagated passively by a user copying it accidentally for example but this isn t self-replication. 2 The population growth of malware describes the overall change in the number of malware instances due to self-replication. Malware that doesn t selfreplicate will always have a zero population growth but malware with a zero population growth may self-replicate. 3 Parasitic malware requires some other executable code in order to exist. Executable in this context should be taken very broadly to include anything that can be executed such as boot block code on a disk binary code 12 COMPUTER VIRUSES AND MALWARE in applications and interpreted code. It also includes source code like application scripting languages and code that may require compilation before being executed. Logic Bomb Self-replicating no Population growth zero Parasitic possibly A logic bomb is code which consists of two parts 1 A payload which is an action to .
