An Executable File Encryption Based Scheme for Malware Defense

Abstract

This paper proposes a scheme for malware defense by encrypting executable files. It is backed by the idea that if an executable file was encrypted, the format of it will become unknown. In order to run such a program, the program loader should be able to access and use the decryption key. And only files decrypted correctly can't be launched. Based on this idea, security rules that make sure only trusted programs can be launched by subjects are defined. Then implementation of the scheme for Windows NT/2000/XP is illustrated, which doesn't require any kinds of modifications to the commercial-off-the-shelf Windows OS with the help of kernel mode file system filter driver and on-the-fly decryption technologies.