Metamorphic malware detection using base malware identification approach

Abstract

Malware is a malicious program that is intentionally developed to harm computer systems. Because the metamorphic malwares are advanced in nature, they mutate their code in each generation by employing code obfuscation techniques to thwart detection. Conventional scanners even fail to detect all variants of such malware. In the view of metamorphic malware detection, we have proposed the concept of machine learning approach like support vector machine with histogram intersection kernel. It has been successfully implemented in the area of image classification, bioinformatics (protein classification and cancer classification). This method provides more accuracy in terms of detection rate to build the effective detection system for metamorphic malwares. In the proposed method, we first extract feature histograms from each portable executable file and map them into the feature space using a histogram intersection kernel. The histogram intersection kernel helps us to find the optimal hyperplane for separating the metamorphic variants from benign programs in a feature space of very high dimension. The results show that our proposed method is capable of detecting metamorphic variants with few false alarms or misses.

Metamorphic Malware Detection Based on Support Vector Machine Classification of Malware Sub-Signatures

“…Earlier studies on metamorphic detection [3][4][5]14] mostly employed opcode-based feature extraction, which is applicable only in host-based detection because of the disassembly requirement. The proposed method overcomes it by extracting the features directly from binaries.…”

“…Some features in old metamorphic malware are kept unchanged in the mutated malware, as malware writers reuse old code segments [1]. Complete mutation of a metamorphic malware is deemed impossible due to the need to keep the same functionality [14]. Most versions of the same malware share a combination of several unchanged code segments [16].…”

“…The learning algorithm trains the SVM classifier to predict if a new file is malware or non-malware. Moreover, the SVM kernal methods can map the features into higher dimensional space by converting nonlinear features into linear ones [14]. Compared to other ML techniques, SVM has been reported to provide the highest malware attack detection accuracy [20].…”

“…Generally, static metamorphic malware detection uses opcodes or opcode n-grams as extracted features for different detection techniques such as ML and statistical analysis [3][4][5]14]. Lately, control flow based method such as by Alam et al [1] statistically analyzed the performance of host-based metamorphic malware detection.…”

Effective methods to detect metamorphic malware: a systematic review

“…However, processing overhead (Carrillo and Lipman, 1988;Santos et al, 2013) and compiler optimisation (Alam et al, 2014a) are examples of challenges to be addressed when Opcode detection is utilised. Further, Opcode distribution has weakness against obfuscation techniques (Mahawer and Nagaraju, 2013;Alam et al, 2014a), and it cannot be used to detect unknown malware (Rezaei et al, 2014a). Vinod et al (2012) used Opcode sequences to calculate the similarity among malware executable files.…”