Evolution and Detection of Polymorphic and Metamorphic Malwares: A Survey
---
paper_title: A Call to Cyber Arms

paper_content:

The People's Liberation Army (PLA) of China calls the electromagnetic spectrum "the fifth domain of battle space," putting cyberspace on an equal footing with ground, air, sea, and space. Augmenting PLA efforts is a legion of civilian researchers and hackers whose efforts are ostensibly directed at repelling electronic intruders. Now that Pandora's box is open, the United States fears that it, too, may someday be on the receiving end of an effective attack. Hackers in China have gathered gigabytes of data on industrial secrets, military hardware, and government strategy for political negotiations.
---
paper_title: Camouflage in Malware: from Encryption to Metamorphism

paper_content:

Summary Camouflage of malware is a serious challenge for antivirus experts and code analysts. Malware use various techniques to camouflage them to not be easily visible and make their lifetime as longer as possible. Although, camouflage approaches cannot fully stop the analyzing and fighting against the malware, but it make the process of analyzing and detection prolonged, so the malware can get more time to widely spread. It is very important for antivirus technologies to improve their products by shortening the detection procedure, not only at the first time facing with a new threat, but also in the future detections. In this paper, we intend to review the concept of camouflage in malware and its evolution from non-stealth days to modern metamorphism. Moreover, we explore obfuscation techniques exploited by metamorphism, the most recent method in malware camouflage.
---
paper_title: Evolution of Computer Virus Concealment and Anti-Virus Techniques: A Short Survey

paper_content:

This paper presents a general overview on evolution of concealment methods in computer viruses and defensive techniques employed by anti-virus products. In order to stay far from the anti-virus scanners, computer viruses gradually improve their codes to make them invisible. On the other hand, anti-virus technologies continually follow the virus tricks and methodologies to overcome their threats. In this process, antivirus experts design and develop new methodologies to make them stronger, more and more, every day. The purpose of this paper is to review these methodologies and outline their strengths and weaknesses to encourage those are interested in more investigation on these areas.
---
paper_title: Camouflage in Malware: from Encryption to Metamorphism

paper_content:

Summary Camouflage of malware is a serious challenge for antivirus experts and code analysts. Malware use various techniques to camouflage them to not be easily visible and make their lifetime as longer as possible. Although, camouflage approaches cannot fully stop the analyzing and fighting against the malware, but it make the process of analyzing and detection prolonged, so the malware can get more time to widely spread. It is very important for antivirus technologies to improve their products by shortening the detection procedure, not only at the first time facing with a new threat, but also in the future detections. In this paper, we intend to review the concept of camouflage in malware and its evolution from non-stealth days to modern metamorphism. Moreover, we explore obfuscation techniques exploited by metamorphism, the most recent method in malware camouflage.
---
paper_title: Camouflage in Malware: from Encryption to Metamorphism

paper_content:

Summary Camouflage of malware is a serious challenge for antivirus experts and code analysts. Malware use various techniques to camouflage them to not be easily visible and make their lifetime as longer as possible. Although, camouflage approaches cannot fully stop the analyzing and fighting against the malware, but it make the process of analyzing and detection prolonged, so the malware can get more time to widely spread. It is very important for antivirus technologies to improve their products by shortening the detection procedure, not only at the first time facing with a new threat, but also in the future detections. In this paper, we intend to review the concept of camouflage in malware and its evolution from non-stealth days to modern metamorphism. Moreover, we explore obfuscation techniques exploited by metamorphism, the most recent method in malware camouflage.
---
paper_title: Evolution of Computer Virus Concealment and Anti-Virus Techniques: A Short Survey

paper_content:

This paper presents a general overview on evolution of concealment methods in computer viruses and defensive techniques employed by anti-virus products. In order to stay far from the anti-virus scanners, computer viruses gradually improve their codes to make them invisible. On the other hand, anti-virus technologies continually follow the virus tricks and methodologies to overcome their threats. In this process, antivirus experts design and develop new methodologies to make them stronger, more and more, every day. The purpose of this paper is to review these methodologies and outline their strengths and weaknesses to encourage those are interested in more investigation on these areas.
---
paper_title: Hunting for metamorphic

paper_content:

As virus writers developed numerous polymorphic engines, virus scanners became stronger in their defense against them. A virus scanner which used a code emulator to detect viruses looked like it was on steroids compared to those without an emulator-based scanning engine. Nowadays, most polymorphic viruses are considered boring. Even though they can be extremely hard to detect, most of today’s products are able to deal with them relatively easily. These are the scanners that survived the DOS polymorphic days. For some of the scanners DOS polymorphic viruses meant the ‘end of days’. Other scanners died with the macro virus problem. For most products the next challenge to take is 32-bit metamorphosis. Metamorphic viruses are nothing new. We have seen them in DOS days, though some of them, like ACG, already used 32-bit instructions. The next step is 32-bit metamorphosis under Windows environments. Virus writers already took the first step in that direction. In this paper the authors will examine metamorphic engines to provide a better general understanding of the problem that we are facing. The authors also provide detection examples of some of the metamorphic viruses.
---
paper_title: Camouflage in Malware: from Encryption to Metamorphism

paper_content:

Summary Camouflage of malware is a serious challenge for antivirus experts and code analysts. Malware use various techniques to camouflage them to not be easily visible and make their lifetime as longer as possible. Although, camouflage approaches cannot fully stop the analyzing and fighting against the malware, but it make the process of analyzing and detection prolonged, so the malware can get more time to widely spread. It is very important for antivirus technologies to improve their products by shortening the detection procedure, not only at the first time facing with a new threat, but also in the future detections. In this paper, we intend to review the concept of camouflage in malware and its evolution from non-stealth days to modern metamorphism. Moreover, we explore obfuscation techniques exploited by metamorphism, the most recent method in malware camouflage.
---
paper_title: Exploring Hidden Markov Models for Virus Analysis: A Semantic Approach

paper_content:

Recent work has presented hidden Markov models (HMMs) as a compelling option for virus identification. However, to date little research has been done to identify the meaning of these hidden states. In this paper, we examine HMMs for four different compilers, hand-written assembly code, three virus construction kits, and a metamorphic virus in order to note similarities and differences in the hidden states of the HMMs. Furthermore, we develop the dueling HMM Strategy, which leverages our knowledge about different compilers for more precise identification. We hope that this approach will allow for the development of better virus detection tools based on HMMs.
---
paper_title: Automatic Generation of String Signatures for Malware Detection

paper_content:

Scanning files for signatures is a proven technology, but exponential growth in unique malware programs has caused an explosion in signature database sizes. One solution to this problem is to use string signatures , each of which is a contiguous byte sequence that potentially can match many variants of a malware family. However, it is not clear how to automatically generate these string signatures with a sufficiently low false positive rate. Hancock is the first string signature generation system that takes on this challenge on a large scale. ::: ::: To minimize the false positive rate, Hancock features a scalable model that estimates the occurrence probability of arbitrary byte sequences in goodware programs, a set of library code identification techniques, and diversity-based heuristics that ensure the contexts in which a signature is embedded in containing malware files are similar to one another. With these techniques combined, Hancock is able to automatically generate string signatures with a false positive rate below 0.1%.
---
paper_title: Evolution of Computer Virus Concealment and Anti-Virus Techniques: A Short Survey

paper_content:

This paper presents a general overview on evolution of concealment methods in computer viruses and defensive techniques employed by anti-virus products. In order to stay far from the anti-virus scanners, computer viruses gradually improve their codes to make them invisible. On the other hand, anti-virus technologies continually follow the virus tricks and methodologies to overcome their threats. In this process, antivirus experts design and develop new methodologies to make them stronger, more and more, every day. The purpose of this paper is to review these methodologies and outline their strengths and weaknesses to encourage those are interested in more investigation on these areas.
---
paper_title: High performance string matching for security applications

paper_content:

Aho-Corasick (AC) algorithm is a commonly used string matching algorithm. It performs multiple patterns matching for computer and network security applications. These applications impose high computational requirements, thus efficient parallelization of the AC algorithm is crucial. In this paper, we present a multi-stream based parallelization approach for the string matching using the AC algorithm on the latest Nvidia Kepler architecture. Our approach efficiently utilizes the HyperQ feature of the Kepler GPU so that multiple steams generated from a number of OpenMP threads running on the host multicore processor can be efficiently executed on a large number of fine-grain processing cores of the GPU. Experimental results show that our approach delivers up to 585Gbps throughput performance on Nvidia Tesla K20 GPU.
---
paper_title: Hunting for metamorphic engines

paper_content:

In this paper, we analyze several metamorphic virus generators. We define a similarity index and use it to precisely quantify the degree of metamorphism that each generator produces. Then we present a detector based on hidden Markov models and we consider a simpler detection method based on our similarity index. Both of these techniques detect all of the metamorphic viruses in our test set with extremely high accuracy. In addition, we show that popular commercial virus scanners do not detect the highly metamorphic virus variants in our test set.
---
paper_title: Detection of Unknown Computer Worms based on Behavioral Classification of the Host Abstract.

paper_content:

Machine learning techniques are widely used in many fields. One of the applications of machine learning in the field of information security is classification of a computer behavior into malicious and benign. Antiviruses consisting of signature-based methods are helpless against new (unknown) computer worms. This paper focuses on the feasibility of accurately detecting unknown worm activity in individual computers while minimizing the required set of features collected from the monitored computer. A comprehensive experiment for testing the feasibility of detecting unknown computer worms, employing several computer configurations, background applications, and user activity, was performed. During the experiments 323 computer features were monitored by an agent that was developed. Four feature selection methods were used to reduce the number of features and four learning algorithms were applied on the resulting feature subsets. The evaluation results suggest that by using classification algorithms applied on only 20 features the mean detection accuracy exceeded 90%, and for specific unknown worms accuracy reached above 99%, while maintaining a low level of false positive rate.
---
paper_title: A survey of data mining techniques for malware detection using file features

paper_content:

This paper presents a survey of data mining techniques for malware detection using file features. The techniques are categorized based upon a three tier hierarchy that includes file features, analysis type and detection type. File features are the features extracted from binary programs, analysis type is either static or dynamic, and the detection type is borrowed from intrusion detection as either misuse or anomaly detection. It provides the reader with the major advancement in the malware research using data mining on file features and categorizes the surveyed work based upon the above stated hierarchy. This served as the major contribution of this paper.
---
paper_title: Zero-day malware detection based on supervised learning algorithms of API call signatures

paper_content:

Zero-day or unknown malware are created using code obfuscation techniques that can modify the parent code to produce offspring copies which have the same functionality but with different signatures. Current techniques reported in literature lack the capability of detecting zero-day malware with the required accuracy and efficiency. In this paper, we have proposed and evaluated a novel method of employing several data mining techniques to detect and classify zero-day malware with high levels of accuracy and efficiency based on the frequency of Windows API calls. This paper describes the methodology employed for the collection of large data sets to train the classifiers, and analyses the performance results of the various data mining algorithms adopted for the study using a fully automated tool developed in this research to conduct the various experimental investigations and evaluation. Through the performance results of these algorithms from our experimental analysis, we are able to evaluate and discuss the advantages of one data mining algorithm over the other for accurately detecting zero-day malware successfully. ::: ::: The data mining framework employed in this research learns through analysing the behavior of existing malicious and benign codes in large datasets. We have employed robust classifiers, namely Naive Bayes (NB) Algorithm, k--Nearest Neighbor (kNN) Algorithm, Sequential Minimal Optimization (SMO) Algorithm with 4 differents kernels (SMO - Normalized PolyKernel, SMO -- PolyKernel, SMO -- Puk, and SMO- Radial Basis Function (RBF)), Backpropagation Neural Networks Algorithm, and J48 decision tree and have evaluated their performance. ::: ::: Overall, the automated data mining system implemented for this study has achieved high true positive (TP) rate of more than 98.5%, and low false positive (FP) rate of less than 0.025, which has not been achieved in literature so far. This is much higher than the required commercial acceptance level indicating that our novel technique is a major leap forward in detecting zero-day malware. This paper also offers future directions for researchers in exploring different aspects of obfuscations that are affecting the IT world today.
---
paper_title: Exploring Hidden Markov Models for Virus Analysis: A Semantic Approach

paper_content:

Recent work has presented hidden Markov models (HMMs) as a compelling option for virus identification. However, to date little research has been done to identify the meaning of these hidden states. In this paper, we examine HMMs for four different compilers, hand-written assembly code, three virus construction kits, and a metamorphic virus in order to note similarities and differences in the hidden states of the HMMs. Furthermore, we develop the dueling HMM Strategy, which leverages our knowledge about different compilers for more precise identification. We hope that this approach will allow for the development of better virus detection tools based on HMMs.
---
paper_title: A similarity metric method of obfuscated malware using function-call graph

paper_content:

Code obfuscating technique plays a significant role to produce new obfuscated malicious programs, generally called malware variants, from previously encountered malwares. However, the traditional signature-based malware detecting method is hard to recognize the up-to-the-minute obfuscated malwares. This paper proposes a method to identify the malware variants based on the function-call graph. Firstly, the function-call graphs were created from the disassembled codes of program; then the caller---callee relationships of functions and the operational code (opcode) information about functions, combining the graph coloring techniques were used to measure the similarity metric between two function-call graphs; at last, the similarity metric was utilized to identify the malware variants from known malwares. The experimental results show that the proposed method is able to identify the obfuscated malicious softwares effectively.
---
paper_title: A General Paradigm for Normalizing Metamorphic Malwares

paper_content:

Nowadays malwares are one of the most important problems of computer society and even people society according to the expansion of computer applications in every dimension of our life. Malware is a malicious code that can harm computer systems and thus makes disorder in their performance. In order to escape from malware detectors, malwares use some obfuscation methods to change their appearance. This problem cannot be solved using traditional malware detection methods since these methods are highly dependent on malware's signatures. So normalization (de-obfuscation) methods have been proposed to confront with these problems. In this paper we propose a general malware normalizer that can store lots of obfuscation methods in the form of automata structures and use them for normalizing metamorphic malwares. Each obfuscation method is modeled using an Augmented DFA, ADFA in short. This paradigm searches the occurrence of obfuscated codes in the source code by traversing these ADFAs. If an obfuscated code is detected in the code, it will be normalized in the next phase and thus the obfuscated malware will be detected easily by traditional malware detectors. The main contribution of this paper is its high generality. It can normalize a wide range of obfuscation methods against current methods that are proposed for confronting with one or a limited set of obfuscation methods. The presented approach is developed and tested on a diverse set of malwares and the results are promising for detecting metamorphic malwares.
---
paper_title: Polymorphic malicious executable scanner by API sequence analysis

paper_content:

The proliferation of malware (viruses, Trojans, and other malicious code) in recent years has presented a serious threat to enterprises, organizations, and individuals. Polymorphic (or variant versions of) computer viruses are more complex and difficult than their original versions to detect, often requiring antivirus companies to spend much time to create the routines needed to catch them. In this paper, we propose a new approach for detecting polymorphic malware in the Windows platform. Our approach rests on an analysis based on the Windows API calling sequence that reflects the behavior of a piece of particular code. The analysis is carried out directly on the PE (portable executable) code. It is achieved in two major steps: construct the API calling sequences for both the known virus and the suspicious code, and perform a similarity measurement between the two sequences after a sequence realignment operation is done. Favorable experimental results are obtained and presented.
---
paper_title: Morphed Virus Family Classification Based on Opcodes Statistical Feature Using Decision Tree

paper_content:

Use of morphing engine in metamorphic and polymorphic malware, and virus creation kits aid malware authors to produce a plenty number of variants for a virus. These variants belong to a family and have common behavioral and some statistical characteristics. However, these variants are not detectable via a single common string signature. Some statistical analyses have been tested in recent years to fight against these types of multi-variants family malware. In this research, we introduce and examine an opcodes statistical-based classifier using decision tree. This method is very simple in implementation. Our experimental outcome shows that different malware family executable files are classifiable using their opcodes statistical feature, with a high degree of reliability.
---
paper_title: Detection of Unknown Computer Worms based on Behavioral Classification of the Host Abstract.

paper_content:

Machine learning techniques are widely used in many fields. One of the applications of machine learning in the field of information security is classification of a computer behavior into malicious and benign. Antiviruses consisting of signature-based methods are helpless against new (unknown) computer worms. This paper focuses on the feasibility of accurately detecting unknown worm activity in individual computers while minimizing the required set of features collected from the monitored computer. A comprehensive experiment for testing the feasibility of detecting unknown computer worms, employing several computer configurations, background applications, and user activity, was performed. During the experiments 323 computer features were monitored by an agent that was developed. Four feature selection methods were used to reduce the number of features and four learning algorithms were applied on the resulting feature subsets. The evaluation results suggest that by using classification algorithms applied on only 20 features the mean detection accuracy exceeded 90%, and for specific unknown worms accuracy reached above 99%, while maintaining a low level of false positive rate.
---
paper_title: Chi-squared distance and metamorphic virus detection

paper_content:

Metamorphic malware changes its internal structure with each generation, while maintaining its original behavior. Current commercial antivirus software generally scan for known malware signatures; therefore, they are not able to detect metamorphic malware that sufficiently morphs its internal structure. Machine learning methods such as hidden Markov models (HMM) have shown promise for detecting hacker-produced metamorphic malware. However, previous research has shown that it is possible to evade HMM-based detection by carefully morphing with content from benign files. In this paper, we combine HMM detection with a statistical technique based on the chi-squared test to build an improved detection method. We discuss our technique in detail and provide experimental evidence to support our claim of improved detection.
---
paper_title: Zero-day malware detection based on supervised learning algorithms of API call signatures

paper_content:

Zero-day or unknown malware are created using code obfuscation techniques that can modify the parent code to produce offspring copies which have the same functionality but with different signatures. Current techniques reported in literature lack the capability of detecting zero-day malware with the required accuracy and efficiency. In this paper, we have proposed and evaluated a novel method of employing several data mining techniques to detect and classify zero-day malware with high levels of accuracy and efficiency based on the frequency of Windows API calls. This paper describes the methodology employed for the collection of large data sets to train the classifiers, and analyses the performance results of the various data mining algorithms adopted for the study using a fully automated tool developed in this research to conduct the various experimental investigations and evaluation. Through the performance results of these algorithms from our experimental analysis, we are able to evaluate and discuss the advantages of one data mining algorithm over the other for accurately detecting zero-day malware successfully. ::: ::: The data mining framework employed in this research learns through analysing the behavior of existing malicious and benign codes in large datasets. We have employed robust classifiers, namely Naive Bayes (NB) Algorithm, k--Nearest Neighbor (kNN) Algorithm, Sequential Minimal Optimization (SMO) Algorithm with 4 differents kernels (SMO - Normalized PolyKernel, SMO -- PolyKernel, SMO -- Puk, and SMO- Radial Basis Function (RBF)), Backpropagation Neural Networks Algorithm, and J48 decision tree and have evaluated their performance. ::: ::: Overall, the automated data mining system implemented for this study has achieved high true positive (TP) rate of more than 98.5%, and low false positive (FP) rate of less than 0.025, which has not been achieved in literature so far. This is much higher than the required commercial acceptance level indicating that our novel technique is a major leap forward in detecting zero-day malware. This paper also offers future directions for researchers in exploring different aspects of obfuscations that are affecting the IT world today.
---
paper_title: A General Paradigm for Normalizing Metamorphic Malwares

paper_content:

Nowadays malwares are one of the most important problems of computer society and even people society according to the expansion of computer applications in every dimension of our life. Malware is a malicious code that can harm computer systems and thus makes disorder in their performance. In order to escape from malware detectors, malwares use some obfuscation methods to change their appearance. This problem cannot be solved using traditional malware detection methods since these methods are highly dependent on malware's signatures. So normalization (de-obfuscation) methods have been proposed to confront with these problems. In this paper we propose a general malware normalizer that can store lots of obfuscation methods in the form of automata structures and use them for normalizing metamorphic malwares. Each obfuscation method is modeled using an Augmented DFA, ADFA in short. This paradigm searches the occurrence of obfuscated codes in the source code by traversing these ADFAs. If an obfuscated code is detected in the code, it will be normalized in the next phase and thus the obfuscated malware will be detected easily by traditional malware detectors. The main contribution of this paper is its high generality. It can normalize a wide range of obfuscation methods against current methods that are proposed for confronting with one or a limited set of obfuscation methods. The presented approach is developed and tested on a diverse set of malwares and the results are promising for detecting metamorphic malwares.
---
paper_title: Droid Analytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

paper_content:

Smartphones and mobile devices are rapidly becoming indispensable devices for many users. Unfortunately, they also become fertile grounds for hackers to deploy malware. There is an urgent need to have a "security analytic & forensic system" which can facilitate analysts to examine, dissect, associate and correlate large number of mobile applications. An effective analytic system needs to address the following questions: How to automatically collect and manage a high volume of mobile malware? How to analyze a zero-day suspicious application, and compare or associate it with existing malware families in the database? How to reveal similar malicious logic in various malware, and to quickly identify the new malicious code segment? In this paper, we present the design and implementation of DroidAnalytics, a signature based analytic system to automatically collect, manage, analyze and extract android malware. The system facilitates analysts to retrieve, associate and reveal malicious logics at the "opcode level". We demonstrate the efficacy of DroidAnalytics using 150, 368 Android applications, and successfully determine 2, 475 Android malware from 102 different families, with 327 of them being zero-day malware samples from six different families. To the best of our knowledge, this is the first reported case in showing such a large Android malware analysis/detection. The evaluation shows the DroidAnalytics is a valuable tool and is effective in analyzing malware repackaging and mutations.
---

Title: Evolution and Detection of Polymorphic and Metamorphic Malwares: A Survey
Section 1: INTRODUCTION
Description 1: This section introduces the concept of malware, its increasing threat, and the need for advanced detection techniques.

Section 2: TYPES OF MALWARES
Description 2: This section classifies malwares into first and second generations and further discusses specific types of second generation malwares which include Encrypted, Oligomorphic, Polymorphic, and Metamorphic Malwares.

Section 3: Encrypted Malwares
Description 3: This subsection elaborates on the first concealment technique used in creating second generation malwares, including how they encrypt the malware body to avoid detection.

Section 4: Oligomorphic Malware
Description 4: This subsection explores how Oligomorphic malwares mutate their decryptors and the limitations of signature-based techniques in detecting them.

Section 5: Polymorphic Malwares
Description 5: This subsection details the mechanisms behind Polymorphic malwares, including their ability to generate millions of different decryptors to evade detection.

Section 6: Metamorphic Malwares
Description 6: This subsection explains how Metamorphic malwares change their entire code structure to create new instances, making them extremely difficult to detect with traditional methods.

Section 7: DETECTION TECHNIQUES
Description 7: This section discusses various techniques used for the detection of malwares, including Signature based detection, Heuristics based detection, Machine Learning, and Malware Normalization methods.

Section 8: Signature based detection
Description 8: This subsection covers the simplest and most common method of detecting known malwares by their unique byte sequences.

Section 9: Heuristics based detection
Description 9: This subsection deals with static and dynamic approaches of heuristics to detect suspicious software behavior and unknown malwares.

Section 10: Machine Learning
Description 10: This subsection discusses the application of machine learning techniques in malware detection, focusing on how learning algorithms can detect both known and unknown malwares.

Section 11: Malware Normalization
Description 11: This subsection elaborates on normalization techniques that improve detection rates by removing obfuscation from malwares before analysis.

Section 12: CONCLUSION
Description 12: This section summarizes the paper, discussing the challenges in malware detection, current techniques, and potential future directions for research and development in combating malware threats.