Int. J. of Multimedia Intelligence and Security   »   2010 Vol.1, No.4

 

 

Title: A highly metamorphic virus generator

 

Author: Priti Desai, Mark Stamp

 

Addresses:
Symantec Corporation, 350 Ellis Street, Mountain View, California, USA.
Department of Computer Science, San Jose State University, One Washington Square, San Jose, California, USA

 

Abstract: Metamorphic viruses modify their code to produce viral copies that are syntactically different from their parents. The viral copies have the same functionality as the parent but typically have no common signature. This makes signature-based virus scanners ineffective for detecting metamorphic viruses. But machine learning tool such as Hidden Markov Models (HMMs) have proven effective at detecting metamorphic viruses. Previous research has shown that most metamorphic generators do not produce a significant degree of metamorphism. In this project, we develop a metamorphic engine that yields highly diverse morphed copies of a base virus. We show that our metamorphic engine easily defeats commercial virus scanners. We then show that, perhaps surprisingly, HMM-based detection is effective against our highly metamorphic viruses. We conclude with a discussion of possible improvements to our generator that might enable it to defeat statistical-based detection methods, such as those that rely on HMMs.

 

Keywords: metamorphic viruses; hidden Markov model; HMM; anti-virus scanning; viral copies; machine learning; virus scanners.

 

DOI: 10.1504/IJMIS.2010.039240

 

Int. J. of Multimedia Intelligence and Security, 2010 Vol.1, No.4, pp.402 - 427

 

Available online: 28 Mar 2011

 

 

Editors Full text accessAccess for SubscribersPurchase this articleComment on this article