Metamorphic malware changes its internal structure on each infection while maintaining its function. Although many detection techniques have been proposed, practical and effective metamorphic detection remains a difficult challenge. In this paper, we analyze a previously proposed eigenvector-based method for metamorphic detection. The approach considered here was inspired by a well-known facial recognition technique. We compute eigenvectors using raw byte data extracted from executables belonging to a metamorphic family. These eigenvectors are then used to compute a score for a collection of executable files that includes family viruses and representative examples of benign code. We perform extensive testing to determine the effectiveness of this classification method. Among other results, we show that this eigenvalue-based approach is effective when applied to a family of highly metamorphic code that successfully evades statistical-based detection. We also experiment computing eigenvectors on extracted opcode sequences, as opposed to raw byte sequences. Our experimental evidence indicates that the use of opcode sequences does not improve the results.
- Computer science,
- Computer engineering,
Available at: http://works.bepress.com/mark_stamp/10/