HUNTING FOR METAMORPHIC

By Peter Szor, Peter Ferrie. 2001

298 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/4e071925c789610a6c4db9d460b5d45b4f1ec861

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Polygraph: automatically generating signatures for polymorphic worms (2005, background): “Our evaluation of these algorithms on a range of polymorphic worms demonstrates that Polygraph produces signatures for polymorphic worms that exhibit low false negatives and false positives.”
A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, background): “(a) Register swap: exchanging registers as demonstrated by code fragments from the RegSwap virus [53].”
On the feasibility of online malware detection with performance counters (2013, methodology): “The malware creators then started randomly mutating the body of the payload by using different compilation strategies (such as choosing different register assignments or padding NOPs) to create variants [10].”
Semantics-aware malware detection (2005, background): “When they replicate, these viruses change their code in a variety of ways, such as code transposition, substitution of equivalent instruction sequences, change of conditional jumps, and register reassignment [28, 35, 36].”
Towards automatic generation of vulnerability-based signatures (2006, background): “Another example, sometimes referred to as metamorphism, is that exploit variants may differ syntactically but be semantically equivalent [28, 52], e.”
A Comprehensive Review on Malware Detection Approaches (2020, background): “However, the encrypted payload portion contains several copies of the decoder and can be encrypted in layered [13].”
Static Analysis of Executables to Detect Malicious Patterns (2003, background): “While there are other generic obfus- cation techniques [11, 12], those described here seem to be preferred by malicious code writers, possibly because implementing them is easy and they add little to the memory footprint.”
Testing malware detectors (2004, background): “Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for pro.t or commercial advantage and that copies bear this notice and the full citation on the .rst page.”
Opcodes as predictor for malware (2007, background): “The theoretical aspects of such metamorphic self-reproducing programmes were presciently laid out 27 years ago (Kraus, 1980) and the emerging practical deployment of such malware predicted in 2001 (Szor and Ferrie, 2001).”
Anagram: A Content Anomaly Detector Resistant to Mimicry Attack (2006, background): “Polymorphic viruses are nothing new; “1260” and the “Dark Avenger Mutation Engine” were considered the first two polymorphic virus engines, written in the early 90s [35].”
Hunting for undetectable metamorphic viruses (2011, background): “However, the virus can still be detected with search strings since the content of each subroutine remains constant [19].”
Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software (2005, background): “Hence, they could be different in other instances of a polymorphic worm (one that uses encryption and code obfuscation so that no two instances are identical [45]), or in different exploits for the same vulnerability.”