Eigenvalue analysis for metamorphic detection

摘要: Metamorphic malware changes its internal structure on each infection while maintaining function. Although many detection techniques have been proposed, practical and effective metamorphic remains a difficult challenge. In this paper, we analyze previously proposed eigenvector-based method for detection. The approach considered here was inspired by well-known facial recognition technique. We compute eigenvectors using raw byte data extracted from executables belonging to family. These are then used score collection of executable files that includes family viruses representative examples benign code. perform extensive testing determine the effectiveness classification method. Among other results, show eigenvalue-based is when applied highly code successfully evades statistical-based also experiment computing opcode sequences, as opposed sequences. Our experimental evidence indicates use sequences does not improve results.