Skip to main content
Article
Structural entropy and metamorphic malware
Journal of Computer Virology and Hacking Techniques (2013)
  • Donabelle Baysas, San Jose State University
  • Richard M. Low, San Jose State University
  • Mark Stamp, San Jose State University
Abstract

Metamorphic malware is capable of changing its internal structure without altering its functionality. A common signature is nonexistent in highly metamorphic malware and, consequently, such malware can remain undetected under standard signature scanning. In this paper, we apply previous work on structural entropy to the metamorphic detection problem. This technique relies on an analysis of variations in the complexity of data within a file. The process consists of two stages, namely, file segmentation and sequence comparison. In the segmentation stage, we use entropy measurements and wavelet analysis to segment files. The second stage measures the similarity of file pairs by computing an edit distance between the sequences of segments obtained in the first stage. We apply this similarity measure to the metamorphic detection problem and show that we obtain strong results in certain challenging cases.

Keywords
  • Computer science,
  • Electronics,
  • telecommunications,
  • hacking techniques,
  • computer virology,
  • entropy,
  • metamorphic
Publication Date
2013
Publisher Statement
SJSU users: use the following link to login and access the article via SJSU databases
Citation Information
Donabelle Baysas, Richard M. Low and Mark Stamp. "Structural entropy and metamorphic malware" Journal of Computer Virology and Hacking Techniques Vol. 9 Iss. 4 (2013)
Available at: http://works.bepress.com/mark_stamp/12/