Skip to main content
Dueling hidden Markov models for virus analysis
Journal of Computer Virology and Hacking Techniques (2015)
  • Mark Stamp, San Jose State University
  • Ashwin Kalbhor, San Jose State University
  • Thomas Austin, San Jose State University
  • Eric Filiol, ESIEA Laboratoire
  • Sébastien Josse, Direction générale de l’armement
Recent work has presented hidden Markov models (HMMs) as a compelling option for malware identification. However, some advanced metamorphic malware like MetaPHOR and MWOR have proven to be more challenging to detect with these techniques. In this paper, we develop the dueling HMM Strategy, which leverages our knowledge about different compilers for more precise identification. We also show how this approach may be combined with previous techniques to minimize the performance overhead. Additionally, we examine the HMMs in order to identify the meaning of these hidden states. We examine HMMs for four different compilers, hand-written assembly code, three virus construction kits, and two metamorphic malware families in order to note similarities and differences in the hidden states of the HMMs.
Publication Date
Publisher Statement
SJSU Users: use the following link to login and access the articles via SJSU databases.
Citation Information
Mark Stamp, Ashwin Kalbhor, Thomas Austin, Eric Filiol, et al.. "Dueling hidden Markov models for virus analysis" Journal of Computer Virology and Hacking Techniques Vol. 11 Iss. 2 (2015) p. 103 - 118 ISSN: 2274-2042
Available at: