Hunting for undetectable metamorphic viruses

By Da Lin, Mark Steven Stamp. 2011

140 citations recorded by the source corpus.

Commercial anti-virus scanners are generally signature based, that is, they scan for known patterns to determine whether a file is infected. To evade signature-based detection, virus writers have employed code obfuscation techniques to create metamorphic viruses. Metamorphic viruses change their internal structure from generation to generation, which can provide an effective defense against signature-based detection. To combat metamorphic viruses, detection tools based on statistical analysis have been studied. A tool that employs hidden Markov models (HMMs) was previously developed and the results are encouraging—it has been shown that metamorphic viruses created by a reasonably strong metamorphic engine can be detected using an HMM. In this paper, we explore whether there are any exploitable weaknesses in an HMM-based detection approach. We create a highly metamorphic virus-generating tool designed specifically to evade HMM-based detection. We then test our engine, showing that we can generate metamorphic copies that cannot be detected using existing HMM-based detection techniques.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Battista Biggio
2. Manuel Günther
3. Giorgio Giacinto
4. Davide Maiorca
5. Andras Rozsa
6. Terrance E. Boult
7. Ethan M. Rudd
8. Maria Elena Chiappe

In Computer Networks and Communications

1. Battista Biggio
2. Giorgio Giacinto
3. Davide Maiorca
4. Maria Elena Chiappe
5. Fabio Roli
6. Andras Rozsa
7. Terrance E. Boult
8. Manuel Günther

In Signal Processing

1. Battista Biggio
2. Giorgio Giacinto
3. Davide Maiorca
4. Fabio Roli
5. Maria Elena Chiappe
6. Andras Rozsa
7. Terrance E. Boult
8. Manuel Günther

Citations in the corpus

• Adversarial Detection of Flash Malware: Limitations and Open Issues (2017, methodology): “In particular, some works employed code obfuscation through off-the-shelf tools or custom techniques [14, 15, 16, 17, 18] to perform evasion.”
• A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, background): “As Lin and Stamp [107] discuss, one problem with HMMs is that it ultimately measures similarity between code sequences; if the inter-class to intra-class sequential variation is large enough due to some exogenous factor such as very similar non-viral code in train/test, then HMM readout may be error”