Chi-squared distance and metamorphic virus detection

摘要: Metamorphic malware changes its internal structure with each generation, while maintaining original behavior. Current commercial antivirus software generally scan for known signatures; therefore, they are not able to detect metamorphic that sufficiently morphs structure. Machine learning methods such as hidden Markov models (HMM) have shown promise detecting hacker-produced malware. However, previous research has it is possible evade HMM-based detection by carefully morphing content from benign files. In this paper, we combine HMM a statistical technique based on the chi-squared test build an improved method. We discuss our in detail and provide experimental evidence support claim of detection.