Hunting for metamorphic engines

Abstract

In this paper, we analyze several metamorphic virus generators. We define a similarity index and use it to precisely quantify the degree of metamorphism that each generator produces. Then we present a detector based on hidden Markov models and we consider a simpler detection method based on our similarity index. Both of these techniques detect all of the metamorphic viruses in our test set with extremely high accuracy. In addition, we show that popular commercial virus scanners do not detect the highly metamorphic virus variants in our test set.

Veil: Private Browsing Semantics Without Browser-side Assistance

“…JavaScript: To mutate JavaScript files, the blinding service uses techniques that are adapted from metamorphic viruses [72]. Metamorphic viruses attempt to elude malware scanners by ensuring that each instantiation of the virus has syntactically different code that preserves the behavior of the base implementation.…”

Compression-based analysis of metamorphic malware

“…Unlike in [30], for example, we examine the raw bytes of a file without the need for code disassembly. We deviate from [3] by considering compression ratios as an alternative measurement of entropy.…”

“…G2 viruses are one of several well-known metamorphic families. The benign files we use to compare against the G2 viruses are 16 specific Cygwin utility files [11] chosen for their representation as non-virus files in previous papers such as [3,21,30]. The exact files included in the benign data set are shown in Table 3.…”

“…Malicious software, or malware, continue to be a threat in spite of advances in computer security [30,35]. The detection of metamorphic malware, in particular, remains a challenging area of research due to various complexities involved [6,33].…”

“…For example, previous work has shown that despite extensive changes in internal structure, some metamorphic malware can be effectively detected using statistical based methods of similarity measurement [30]. It has also been shown that metamorphic malware can be clustered by using compression ratios as a measure of Kolmogorov complexity [29].…”