Sequences and Beyond

As virus labs are flooded with new samples every day, proactive malware detection is the top priority. It is the best solution for handling families with thousands of new variants a day. Besides, that can prevent users from getting infected at the appearance of a new malicious sample.
In particular, generic detection technologies play a very important role in the arsenal of proactive detections. While a huge selection of advanced technologies exist, ranging from behavior based detection to cloud scanning, we should not forget the good old signature scanning. Not in its classic form, but with the aid of contemporary pattern matching techniques – fitted for the special needs of virus signatures. This presentation gives an overview of the miracles an experienced analyst can achieve, if assisted by some advanced features of pattern matching. The presentation is supported by a selection of up-to-date real life examples.
Gabor Szappanos graduated from the Eotvos Lorand University of Budapest with degree in physics. His first job was in the Computer and Automation Research Institute, developing diagnostic software and hardware for nuclear power plants. He started antivirus work in 1995, and has been developing freeware antivirus solutions in spare time. He did on-contract job in developing the Virus ALERT for Macros product family.
He was also an editor of a Hungarian magazine Uj Alaplap, running the section “Virus Patrol”, until the magazine discontinued. He joined VirusBuster in 2001 where he was responsible for taking care of macro virus and script malware. Since 2002 he is the head of the virus lab. He is a frequent speaker of antivirus conferences, authored several articles on malware analysis. Since 2008 he is a member of the board of directors in AMTSO (Anti Malware Testing Standards Organizations).
Mr. Szappanos graduated from the Eotvos Lorand University of Budapest with degree in physics. His first job was in the Computer and Automation Research Institute, developing diagnostic software and hardware for nuclear power plants. He started antivirus work in 1995, and has been developing freeware antivirus solutions in spare time. He did on-contract job in developing the Virus ALERT for Macros product family.
Gabor Szappanos was also an editor of a Hungarian magazine Uj Alaplap, running the section “Virus Patrol”, until the magazine discontinued. He joined VirusBuster in 2001 where he was responsible for taking care of macro virus and script malware. Since 2002 he is the head of the virus lab. He is a frequent speaker of antivirus conferences, authored several articles on malware analysis. Since 2008 he is a member of the board of directors in AMTSO (Anti Malware Testing Standards Organizations).