In this paper, we present a novel approach for the detection and signature extraction for a subclass of polymorphic computer viruses. Our detection scheme offers 0 false negative and a very low false positives detection rate. We use context-free grammars as viral signatures, and design a process able to extract this signature from a single sample of a virus. Signature extraction is achieved through a light manual information gathering process, followed by an automatic static analysis of the binary code of the virus mutation engine.

In this paper we propose a hardware assisted software protection scheme that relies on the use of a resource-limited secure token (e.g. a smart card). The protection consists in externalizing the execution of the sensitive pieces of code of the application to be protected to the token block by block, while the unsensitive code is still executed inside the untrusted computer. We define a generic process: the protection is enforced automatically. Our method relies on static analysis techniques that are used to infer the parts of code to be externalized together with run-time externalization protocol. We have developed a software environment implementing this technology for Java applications.