Skip to main content
Article
Eigenvalue analysis for metamorphic detection
Journal of Computer Virology and Hacking Techniques (2014)
  • Sayali Deshpande, San Jose State University
  • Younghee Park, San Jose State University
  • Mark Stamp, San Jose State University
Abstract

Metamorphic malware changes its internal structure on each infection while maintaining its function. Although many detection techniques have been proposed, practical and effective metamorphic detection remains a difficult challenge. In this paper, we analyze a previously proposed eigenvector-based method for metamorphic detection. The approach considered here was inspired by a well-known facial recognition technique. We compute eigenvectors using raw byte data extracted from executables belonging to a metamorphic family. These eigenvectors are then used to compute a score for a collection of executable files that includes family viruses and representative examples of benign code. We perform extensive testing to determine the effectiveness of this classification method. Among other results, we show that this eigenvalue-based approach is effective when applied to a family of highly metamorphic code that successfully evades statistical-based detection. We also experiment computing eigenvectors on extracted opcode sequences, as opposed to raw byte sequences. Our experimental evidence indicates that the use of opcode sequences does not improve the results.

Keywords
  • Metamorphic,
  • detection,
  • Computer science,
  • Computer engineering,
  • telecomunication,
  • Eigenvalue
Publication Date
2014
Publisher Statement
SJSU users: use the following link to login and access the article via SJSU databases
Citation Information
Sayali Deshpande, Younghee Park and Mark Stamp. "Eigenvalue analysis for metamorphic detection" Journal of Computer Virology and Hacking Techniques Vol. 10 Iss. 1 (2014)
Available at: http://works.bepress.com/mark_stamp/10/