How can one (efficiently) differentiate between malicious and non-malicious software and how can this be formalized and automated? This is one of many fundamental problems within software engineering which is becoming more acute with society’s increasing reliance on cyber-physical systems. In fact, it is one of many problems in dire need of a deep conceptual and so philosophical analysis, not just for the mere pleasure of defining and classifying, but because such reflections help improving our software. One basic challenge within the security context then is to understand what malicious software is today (indeed, also malware can and should be seen as a historical object) and, so, whether one can identify different types of so-called malware. Existing proposals of taxonomies are too focused on specific details and, hence, system-specific – a generalizing approach is needed. This is the task that Primiero, Solheim and Spring set out for themselves in a recent paper:
“On malfunction, mechanism and malware classification.” Philosophy and Technology, 2018, https://doi.org/10.1007/s13347-018-0334-2, available here.
Starting out from an existing taxonomy, they propose a generalized framework, extending it to intended disruptions of normal software functionality. In a first analysis, the understanding of malware is functionalist, viz. in terms of the damage done (e.g. is the intent of the attack merely to monitor and possible steal data or is it disruptive?). This functionalist understanding is then connected with the use of mechanistic modeling strategies to clarify and, ultimately, facilitate malicious software classifications. Of course, the authors’ ambition is to propose this analysis as a first stepping stone towards provable and verifiable reasoning about malware. We are looking forward to the next steps in this endeavour.