Abstract-A virus is a program that replicates itself by copying its code into other files. A common virus protection mechanism involves scanning files to detect code patterns of known viruses. We prove that the problem of reliably identifying a bounded-length mutating virus is NP-complete by showing that a virus detector for a certain virus strain can be used to solve the satisfiability problem. The implication of this result is that virus identification methods will be facing increasing strain as virus mutation and hosting strategies mature, and that different protection methods should be developed and employed. 1 2
Spinellis showed that identification of bounded length metamorphic virii is NP-complete REF by decomposing the problem into one of graph isomorphism.
Reliable identification of bounded-length viruses is NP-complete
IEEE Transactions on Information Theory
Computer Science