Compression-based analysis of metamorphic malware

Lee, John; Austin, Thomas H.; Stamp, Mark

doi:10.1504/ijsn.2015.070426

Cited by 15 publications

(18 citation statements)

References 24 publications

(49 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Previous research [2,15] has shown that HMMs trained on opcode sequences and/or function call-graphs can effectively classify different families of malware.…”

Section: Hmm For Malware Detectionmentioning

confidence: 99%

Clustering versus SVM for malware detection

Narra

Troia

Visaggio

et al. 2015

J Comput Virol Hack Tech

Self Cite

View full text Add to dashboard Cite

Clustering versus SVM for Malware Detection by Usha NarraPrevious work has shown that we can effectively cluster certain classes of malware into their respective families. In this research, we extend this previous work to the problem of developing an automated malware detection system. We first compute clusters for a collection of malware families. Then we analyze the effectiveness of classifying new samples based on these existing clusters. We compare results obtained using -means and Expectation Maximization (EM) clustering to those obtained using Support Vector Machines (SVM). Using clustering, we are able to detect some malware families with an accuracy comparable to that of SVMs. One advantage of the clustering approach is that there is no need to retrain for new malware families.

show abstract

“…Previous research [2,15] has shown that HMMs trained on opcode sequences and/or function call-graphs can effectively classify different families of malware.…”

Section: Hmm For Malware Detectionmentioning

confidence: 99%

Clustering versus SVM for malware detection

Narra

Troia

Visaggio

et al. 2015

J Comput Virol Hack Tech

Self Cite

View full text Add to dashboard Cite

show abstract

“…It has produced good results for polymorphic malware and metamorphic malware [2,16]. Unlike other techniques, this technique will not work on opcode sequence; it works on raw byte of the file.…”

Section: Structural Entropymentioning

confidence: 99%

“…The proposed technique for detection of software piracy is an extension of the technique presented in [2,16]. Our technique can be divided into two major parts: file segmentation and sequence comparison.…”

Section: Structural Entropymentioning

confidence: 99%

“…File segmentation achieved using Shannon's formula, where entropy is calculated. Once entropy is calculated, wavelet transform is applied [16]. Figure 7 gives the pictorial representation of segmentation process.…”

Section: Structural Entropymentioning

confidence: 99%

“…The techniques we analyze in this paper were inspired by previous research on metamorphic virus detection [13,16,26,27,44]. Metamorphic malware changes its internal structure at each infection, while maintaining its essential function.…”

mentioning

confidence: 99%

See 2 more Smart Citations

Hunting for Pirated Software Using Metamorphic Analysis

Rana

Stamp

2014

Information Security Journal: A Global Perspective

Self Cite

View full text Add to dashboard Cite

Hunting for Pirated Software Using Metamorphic Analysis by Hardikkumar RanaIn this paper, we consider the problem of detecting software that has been pirated and modified. We analyze a variety of detection techniques that have been previously studied in the context of malware detection. For each technique, we empirically determine the detection rate as a function of the degree of modification of the original code. We show that the code must be greatly modified before we fail to reliably distinguish it, and we show that our results offer a significant improvement over previous related work. Our approach can be applied retroactively to any existing software and hence, it is both practical and effective.

show abstract

Evolutionary Based Transfer Learning Approach to Improving Classification of Metamorphic Malware

Babaagba¹,

Ayodele²

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The proliferation of metamorphic malware has recently gained a lot of research interest. This is because of their ability to transform their program codes stochastically. Several detectors are unable to detect this malware family because of how quickly they obfuscate their code.It has also been shown that Machine learning (ML) models are not robust to these attacks due to the insufficient data to train these models resulting from the constant code mutation of metamorphic malware. Although recent studies have shown how to generate samples of metamorphic malware to serve as training data, this process can be computationally expensive. One way to improve the performance of these ML models is to transfer learning from other fields which have robust models such as what has been done with the transfer of learning from computer vision and image processing to improve malware detection. In this work, we introduce an evolutionary based transfer learning approach that uses evolved mutants of malware generated using a traditional Evolutionary Algorithm (EA) as well as models from Natural Language Processing (NLP) text classification to improve the classification of metamorphic malware. Our preliminary results demonstrate that using NLP models can improve the classification of metamorphic malware in some instances.

show abstract

Compression-based analysis of metamorphic malware

Cited by 15 publications

References 24 publications

Clustering versus SVM for malware detection

Clustering versus SVM for malware detection

Hunting for Pirated Software Using Metamorphic Analysis

Evolutionary Based Transfer Learning Approach to Improving Classification of Metamorphic Malware

Contact Info

Product

Resources

About