What algorithms are used in signature and heuristic virus detection? [closed]

I'm trying to write a paper on virus detection techniques. I've downloaded many journals, papers and used many websites. I have found overview definition for both of these terms but I would like to go in more in depth regarding these topics.

For example simple concrete examples of one or several of the algorithms used?

Thanks for any help.

-

closed as off topic by Ƭᴇcʜιᴇ007, soandos, Dave M, ChrisF, Sathya♦Apr 21 '12 at 12:52

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

A simple example of signature virus detection is just hashing the virus with several different algorithms. If a file with those signatures is spotted, then it is most probably (though not definitely, as collisions are possible but highly unlikely) a virus. While in practice this is difficult (polymorphic viruses make this an almost unworkable solution in many cases) the theory is simple.

A heuristic in its most basic form basically defines "suspicious behavior" or "suspicious code" and acts on that. So for example (this is very oversimplified again) if a program is trying to add itself to the list of start-up programs, is not signed by a trusted publisher, and is trying to access the internet, it MIGHT be a virus. It might just be an installer though.

This is a fairly simple example of why heuristics are more probabilistic than deterministic, where as signatures are the other way around.

Just as a short comparison:

Heuristics: Has false positives and negatives, but generally low on both (ideally).
Signatures: Has false negatives, but almost never false positives.

-
Thanks for these nice similar explanations. I am aware that companies won't publish their algorithms as this is what they make their money on after all but are there not some really simple old algorithms floating about that were used in the past that I could use to show some deeper understanding? I tried to understand Aho-Corasick and Veldman for signature detect but really didn't understand! – Ed Briscoe Apr 20 '12 at 21:59
Not sure if you got the full edit or not – Ed Briscoe Apr 20 '12 at 22:07