Software repairs itself after computer virus infection

Researchers at the University of Utah have written security software that can detect infections from unknown viruses and then immediately repair the damage done. The software reportedly fixed the well-known Shellshock bug within minutes.

The software package is called A3 and runs in a virtual machine. A3, short for Advanced Adaptive Applications, consists of several debuggers running on top of each other simultaneously. The programs monitor each other and the virtual machine, looking for abnormal activities on the machine. A3 intervenes as soon as something is not right.

The security package works differently from regular antivirus software, the researchers claim. A3 would be able to automatically detect new, unknown viruses by the debuggers as soon as something wrong happens on the computer. A3 can then stop the malware, restore the software and ‘learn’ never to let the malware in again. Although most traditional virus scanners also work with a heuristic scanning method, they do not use debuggers for this. Heuristic scanning can detect unknown malware based on suspicious behavior.

The A3 software package was developed by the University of Utah to protect Linux servers from malware. To this end, the university collaborated with Darpa, the research institute of the US Department of Defense, among others. The development process took four years and the software was only demonstrated for the first time in September, it was announced this week.

The first findings seem encouraging, writes Phys.org, among others, based on information from the American university. At a demonstration at Darpa in September, the package reportedly immediately recognized the then-new Bash security problem Shellshock. In addition, the software recovered from the attack within four minutes, the researchers claim. Shellshock allowed attackers to put their own code in an environment variable, after which the code was executed as soon as a system initiated a Bash session.

For the time being, no concrete applications have been developed based on A3. There are also no plans yet to provide home computers and laptops with the software, which has been released as open source. The researchers just don’t rule this out for the future. They say they still want to do research into this, but first they want to see what the software can mean for large server parks, such as those of Amazon.