Dueling hidden Markov models for virus analysisJournal of Computer Virology and Hacking Techniques (2015)
Recent work has presented hidden Markov models (HMMs) as a compelling option for malware identification. However, some advanced metamorphic malware like MetaPHOR and MWOR have proven to be more challenging to detect with these techniques. In this paper, we develop the dueling HMM Strategy, which leverages our knowledge about different compilers for more precise identification. We also show how this approach may be combined with previous techniques to minimize the performance overhead. Additionally, we examine the HMMs in order to identify the meaning of these hidden states. We examine HMMs for four different compilers, hand-written assembly code, three virus construction kits, and two metamorphic malware families in order to note similarities and differences in the hidden states of the HMMs.
Citation InformationMark Stamp, Ashwin Kalbhor, Thomas Austin, Eric Filiol, et al.. "Dueling hidden Markov models for virus analysis" Journal of Computer Virology and Hacking Techniques Vol. 11 Iss. 2 (2015) p. 103 - 118 ISSN: 2274-2042
Available at: http://works.bepress.com/mark_stamp/33/