Control Flow-Based Malware VariantDetection

摘要: Static detection of malware variants plays an important role in system security and control flow has been shown as effective characteristic that represents polymorphic malware. In our research, we propose a similarity search to detect these using novel distance metrics. We describe signature by the set flowgraphs contains. use metric based on between feature vectors string-based signatures. The vector is decomposition graphs into either fixed size k-subgraphs, or q-gram strings high-level source after decompilation. this perform pre-filtering. also more but less computationally efficient minimum matching distance. uses string edit distances programs’ decompiled flowgraphs, linear sum assignment problem construct weight two sets graphs. implement metrics complete variant system. evaluation shows approach highly terms limited false positive rate detects when compared rates other algorithms.