Hunting for metamorphic JavaScript malware

Abstract

Hunting For Metamorphic JavaScript Malware by Mangesh MusaleInternet plays a major role in the propagation of malware. A recent trend is the infection of machines through web pages, often due to malicious code inserted in JavaScript. From the malware writer's perspective, one potential advantage of JavaScript is that powerful code obfuscation techniques can be applied to evade detection. In this research, we analyze metamorphic JavaScript malware. We compare the effectiveness of several static detection strategies and we quantify the degree of morphing required to defeat each of these techniques. ACKNOWLEDGMENTS

Metamorphic malware detection using Linear Discriminant Analysis and Graph Similarity

“…The result is not very promising for MWOR with high padding ratio although area under the curve (AUC) is quite well for lower padding ratio. In [19] authors illustrate that OGS is a reliable method for Javascript metamorphic mal ware detection. It has better accuracy than HMM and other well-known methods for metamorphic malware detection.…”

“…Future work could include detailed examination on the parameters of the proposed approach. In addition, with regard to [19], it is possible that Improved OGS would have better accuracy for Javascript malware detection. Therefore, using our method for Javascript mal ware detection could leads to interesting result.…”

A cyber kill chain based taxonomy of banking Trojans for evolutionary computational intelligence

“…This technique is quite often used and 76 of Trojans analysed have indicated utilisation of this technique (see Appendix II). While this technique could be circumvented by removing ineffective instructions prior to analysis, detecting those instructions is quite time consuming [26], [74]- [78].…”

Support Vector Machines and Metamorphic Malware Detection

“…One of such technique is Hidden Markov Model (HMM), which is one of the most popular machine learning techniques used in the field of malware detection [26]. In this technique, a Hidden Markov Model is trained against known malware opcode sequence [17]. Once the training phase is over, the trained model is used to score incoming files.…”