Obfuscated computer virus detection using machine learning algorithm

Abstract

Nowadays, computer virus attacks are getting very advanced. New obfuscated computer virus created by computer virus writers will generate a new shape of computer virus automatically for every single iteration and download. This constantly evolving computer virus has caused significant threat to information security of computer users, organizations and even government. However, signature based detection technique which is used by the conventional anti-computer virus software in the market fails to identify it as signatures are unavailable. This research proposed an alternative approach to the traditional signature based detection method and investigated the use of machine learning technique for obfuscated computer virus detection. In this work, text strings are used and have been extracted from virus program codes as the features to generate a suitable classifier model that can correctly classify obfuscated virus files. Text string feature is used as it is informative and potentially only use small amount of memory space. Results show that unknown files can be correctly classified with 99.5% accuracy using SMO classifier model. Thus, it is believed that current computer virus defense can be strengthening through machine learning approach.

Malware Analysis and Reverse Engineering: Unraveling the Digital Threat Landscape

“…Figure 2: IDA Pro Description: IDA Pro is a disassembling and debugging tool that assists an analyst in understanding the assembly language of any executable file. (See Figure 2) [11] Use Case: IDA Pro offers a full perspective on the binaries that contain malware's structure and code, usually when reversing engineering malware.…”

“…Specialized tools such as IDA Pro and Ghidra offer detailed representations of the code, enabling the tracing of vital features and operations that can be carried out during disassembly. [11][12]…”

“…For instance, in the case of a malware specimen that imitates authentic software, initially, the binary will be disassembled by an analyst using a tool such as IDA Pro in order to reverse engineer this malware. [11][17] The assembly code revealed during disassembly assists in deciphering the program's purpose and identifying potential malicious activities. Subsequently, the analyst can then run the malware in a controlled environment using a debugger like OllyDbg.…”

“…[20][21][22] Particularly encrypted payloads necessitate specialized decryption and key discovery routines to reveal their nefarious motives. [11][23] The existence of these problems illustrates the continuing struggle between malware writers and analysts, each striving to stay ahead of the other.…”