And I assume you’re referring to the proposition that an algorithm that has to decide if a program is a virus or not, can be mathematically proved to be a special case to the Halting Problem, for which Turing proved it was undecidable?

I don’t know the exact details of Fred Cohen’s proof, but are you sure that this applies to signature based detection? Because signature based detection means that an algorithm has to decide if a file contains a given sequence or several sequences of bytes (i.e. the signature). I don’t believe this particular algorithm is undecidable.

With signature based detection, it’s the virus analyst defining the signature (I’m excluding automatic signature generation here) that decides which samples are viruses.

]]>