Abstract
Metamorphic malware changes its internal structure with each generation, while maintaining its original behavior. Current commercial antivirus software generally scan for known malware signatures; therefore, they are not able to detect metamorphic malware that sufficiently morphs its internal structure. Machine learning methods such as hidden Markov models (HMM) have shown promise for detecting hacker-produced metamorphic malware. However, previous research has shown that it is possible to evade HMM-based detection by carefully morphing with content from benign files. In this paper, we combine HMM detection with a statistical technique based on the chi-squared test to build an improved detection method. We discuss our technique in detail and provide experimental evidence to support our claim of improved detection.










Similar content being viewed by others
Notes
The \(\Gamma \) function can be viewed as a generalization of the factorial function; for positive integers \(n\), we have \(\Gamma (n) = (n-1)!\).
References
Aho, A.V., Corasick, M.J.: Efficient string matching: an aid to bibliographic search. Commun. ACM 18, 333–340 (1975)
Ataman, K., Street, W.N., Zhang, Y.: Learning to rank by maximizing auc with linear programming. IEEE Technical Report (2006)
Austin, T.H., Filiol, E., Josse, S., Stamp, M.: Exploring hidden Markov models for virus analysis: a semantic approach (2012) (submitted)
Aycock, J.: Computer Viruses and Malware. Springer, Berlin (2006)
Chess, D., White, S.: An undetectable computer virus. Virus Bulletin Conference (2000)
Borello, J., Me, L.: Code obfuscation techniques for metamorphic viruses. J. Comput. Virol. 4(3), 211–220 (2008)
Coulter, F., Eichorn, K.: A good decade for cybercrime. McAfee, Inc., Technical Report (2011)
Cygwin September 2011, [online]. Available at http://www.cygwin.com (2011)
Desai, P., Stamp, M.: A highly metamorphic virus generator. Int. J. Multimed. Intell. Security 1(4), 402–427 (2010)
Egan, J.: Signal Detection Theory and ROC Analysis. Academic Press, New York (1975)
Filiol, E., Josse, S.: A statistical model for undecidable viral detection. J. Comput. Virol. 3(1), 65–74 (2007)
Geisser, S.: Predictive Inference: An Introduction. Chapman and Hall, London (1993)
IDAPro, Interactive dissassembler, 2011, [online]. Available at http://www.hex-rays.com/products/ida/index.shtml
Intel, Intel®Architecture Software Developer’s Manual, vol. 2. Instruction Set Reference Manual, October (2011)
Kolter, J., Maloof, M.: Learning to detect malicious executables in the wild. Proceedings of KDD ’04 (2004)
Lin, D., Stamp, M.: Hunting for undetectable metamorphic viruses. J. Comput. Virol. 7(3), 201–214 (2011)
Mitchell, T.: Machine Learning. McGraw Hill, New York (1997)
Schultz, M., Eskin, E., Zadok, E.: Data mining methods for data mining methods for detection of new malicious executables. Proceedings of IEEE International Conference on Data Mining (2001)
Madenur Sridhara, S.: Metamorphic worm that carries its own morphing engine, Master’s Projects, Paper 240, (2012). http://scholarworks.sjsu.edu/etd_projects/240
Madenur Sridhara, S., Stamp, M.: Metamorphic worm that carries its own morphing engine (2012) (submitted)
Stamp, M.: Information Security: Principles and Practice. Wiley, New York (2011)
Stamp, M.: A revealing introduction to hidden Markov models, [online]. Available at http://www.cs.sjsu.edu/faculty/RUA/HMM.pdf
Ször, P.: The Art of Computer Virus Research and Defense. Addition Wesley Professional, Boston (2005)
Ször P., Ferrie P.: Hunting for metamorphic. Virus Bull. 123–144 (2001)
Thrun, S., Saul, L.K., Scholkopf, B. (eds.): AUC Optimization vs Error Rate Minimization. MIT Press, Cambridge (2004)
Toderici, A.H.: Chi-squared distance and metamorphic virus detection. Department of Computer Science, San Jose State University, May, Master’s Thesis (2012)
Vx heavens, [online]. Available at http://www.vx.netlux.org/
Wang, R.: Flash in the pan? Virus Bull. (1998)
Wong, W.: Analysis and detection of metamorphic computer viruses. Department of Computer Science, San Jose State University, May, Master’s Thesis (2006)
Wong, W., Stamp, M.: Hunting for metamorphic engines. J. Comput. Virol. 2(3), 211–229 (2006)
Author information
Authors and Affiliations
Corresponding author
Rights and permissions
About this article
Cite this article
Toderici, A.H., Stamp , M. Chi-squared distance and metamorphic virus detection. J Comput Virol Hack Tech 9, 1–14 (2013). https://doi.org/10.1007/s11416-012-0171-2
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s11416-012-0171-2