Supervisory control of malicious executables

This paper presents a systems-theoretic approach to profile, model, and control malicious executables in computer software. By treating the structural profile of malicious codes as a generator of formal languages, the language recognizer serves as a supervisory controller in the sense that the spread of malicious executables is arrested with the goal of making the virus ineffective. The theoretical foundation and the approach presented in this paper are applicable to a wide class of malicious executables. The controller can be designed as a separate program or as a background process to run on individual machines to monitor other processes. Simulation experiments on supervisory control of a file virus are presented as examples.