Article
Dueling hidden Markov models for virus analysis
Journal of Computer Virology and Hacking Techniques
(2015)
Abstract
Recent work has presented hidden Markov models (HMMs) as a compelling option for malware identification. However, some advanced metamorphic malware like MetaPHOR and MWOR have proven to be more challenging to detect with these techniques. In this paper, we develop the dueling HMM Strategy, which leverages our knowledge about different compilers for more precise identification. We also show how this approach may be combined with previous techniques to minimize the performance overhead. Additionally, we examine the HMMs in order to identify the meaning of these hidden states. We examine HMMs for four different compilers, hand-written assembly code, three virus construction kits, and two metamorphic malware families in order to note similarities and differences in the hidden states of the HMMs.
Disciplines
Publication Date
2015
DOI
10.1007/s11416-014-0232-9
Publisher Statement
SJSU Users: use the following link to login and access the articles via SJSU databases.
Citation Information
Mark Stamp, Ashwin Kalbhor, Thomas Austin, Eric Filiol, et al.. "Dueling hidden Markov models for virus analysis" Journal of Computer Virology and Hacking Techniques Vol. 11 Iss. 2 (2015) p. 103 - 118 ISSN: 2274-2042 Available at: http://works.bepress.com/mark_stamp/33/