New malware classification system

Kaspersky Lab is currently switching to a new malware classification system

The new system will make it easier to navigate the virus descriptions.

Naming of malicious programs

Each malicious program is given a name which has several parts.

Any program which is given a name containing the term VirWare, TrojWare, MalWare, RiskWare, AdWare or PornWare will be a malicious program.

The name of each malicious program can be broken down in the following way:

Verdict: verdict clarification

Verdict clarification includes the following categories:

Behaviour[-Sub-behaviour].OS.Name[-Modification:]

Verdict: this is an umbrella description which covers the main characteristics of a virus sample: VirWare, TrojWare, MalWare, RiskWare, AdWare, PornWare, SPAM, or Attack.

Behaviour: this defines the malicious program’s payload. Backdoor, Virus etc. are all examples of Behaviour. A less threatening behaviour will be subsumed by the most threatening behaviour. For example, if a program has a backdoor function, but also infects files, the behaviour will be classified as Virus. If in addition to these behaviours, the malicious program spreads via network connections, the behaviour will be classified as Worm.

Sub-behaviour: this category is only used if the malicious program has a sub-behavior. It defines the main behaviour further. For instance, a malicious program classified as Trojan-Spy has the sub-behaviour Spy and so on. The sub-behaviour term is separated from the behavior term by a dash.

In the case of worms, the sub-behaviour term will be a prefix to the main behaviour term: P2P-Worm, Net-Worm etc.

OS gives the operating system in which the malicious program functions eg. Win32, BAT, IRC etc.

Name: the name which the Virus Lab has given to the malicious program.

Modification: shows the different versions of a malicious program grouped under one name.

An example of a name under the new classification system would be Trojan-Dropper.Win32.Agent.a – a Trojan which drops another malicious program, operates in Win32. The Virus Lab has named this program Agent, and this particular program is modification a, the first in a series.

Names of malicious programs always include the Behaviour, OS, Name and Modification terms.