System Software: Question 8

Worked solution

Part (a): Signature-based detection

An antivirus utility keeps a database of virus signatures. Short, distinctive patterns of code that have been identified within known pieces of malware. When Bilal’s downloaded file is scanned, the antivirus utility compares patterns found within that file’s own code against every signature stored in its database. If it finds a match, the file is identified (flagged) as containing that particular piece of malware. [2 marks]: [1] for identifying that the file’s code is compared against a database of known virus signatures, [1] for stating that a match identifies the file as infected.

Part (b): Actions taken on an infected file

If the file is identified as infected, the antivirus utility might, for example, quarantine it (move it to an isolated, secure area of storage where it cannot run or affect the rest of the computer) or delete it. It might also warn Bilal and prevent the file from being opened until he chooses what to do with it. [2 marks] for two valid actions.

Part (c): Why the signature database needs regular updates

New malware is being created all the time, and each new piece of malware has its own new signature that will not already be present in an older database. An antivirus utility can only detect malware whose signature it already has stored, so if its database were installed once and never updated, it would still correctly detect older, already-known malware, but would fail to recognise any newly created malware released since the last update. Regular updates add these newly discovered signatures to the database, keeping the antivirus utility able to detect the malware currently in circulation. [2 marks]: [1] for stating that new malware is created constantly, [1] for explaining that detection depends on a matching signature already being in the database.

Part (d): Other files that need scanning too

An antivirus utility should also regularly scan files from other sources, for example a file downloaded from a website, or a file copied from a USB flash drive. Scanning only email attachments would leave Bilal’s computer only partly protected, because malware is not limited to arriving as an email attachment. An infected file could just as easily reach his computer through a website download, removable storage such as a USB drive, or a file shared over a network, so all of these need to be scanned as well to fully protect the computer. [2 marks]: [1] for stating a valid other file source, [1] for explaining that malware can reach the computer through routes other than email attachments.

Final answers

• (a) The file’s code is compared against a database of known virus signatures; a match identifies it as infected.
• (b) Any two of: quarantine, delete, warn the user and block the file from opening.
• (c) New malware appears constantly, and only malware whose signature is already in the database can be detected, so the database needs regular updates.
• (d) For example, a website download or a USB flash drive file; other routes besides email attachments can also carry malware, so they also need scanning.