A Syntactic Approach for Detecting Viral Polymorphic Malware Variants

Exploring the Effects of Gap-Penalties in Sequence-Alignment Approach to Polymorphic Virus Detection

“…In contrast, our syntactic approach is independent of any prior semantic knowledge. The syntactic approach most closely related to ours [53] adds nothing new to what was reported by Chen et al's approach in 2012 [28], and repeats the structural sequence alignment and data mining approaches adopted in that paper and subsequently enhanced by [29] [30] [31].…”

“…The most effective signatures were determined to be the signatures that detected over 90% of the variants. These signatures were placed inside our own generated (.ndb) database [29], which is used by Clamscan as a recommended database file format for signature testing purposes. Detection performance for each of the three viruses was measured using the following metrics: true positive rate (sensitivity), true negative rate (specificity), positive predictive value (precision), detection ratio reported by the "TopTenReviews" [71] website.…”

“…These consensuses were in turn multiply aligned with each other to generate a common consensus (i.e. a meta-signature) for all variants [29] [30]. A by-product of alignment is that variable-length viral sequences become of fixed length and longer through the introduction of gaps.…”

“…The aim of this paper is to examine whether string searching algorithms of greater sophistication than those investigated previously by Naidu and Narayanan [29], such as the Smith-Waterman algorithm which unlike previous work [29] includes different combinations of gap open and gap extend penalties, can lead to the automatic generation of signatures not just for known variants but also for unknown (future), or newly generated, variants. In order to In Section 2 and Section 3, we discuss the background of syntactic techniques and previous related work.…”

“…and "mouse seen cat" that will help to detect all four sentences as variants despite the variable length of the sentences, the movement of tokens within the A sequence-based approach to signature extraction was previously proposed and demonstrated using the Smith-Waterman algorithm (SWA) without gap penalties [29]. SWA is used extensively in bioinformatics for sequence alignment (finding common subsequences or consensuses among a set of variable length sequences), and previous work demonstrated the feasibility of using such consensuses in viral hex code as signatures.…”