Polymorphic and metamorphic malware detection

摘要: Software attacks are a serious problem. Conventional anti-malware software expects malicious software, malware, to contain fixed and known code. Malware writers have devised methods of concealing or constantly changing their evade software. Two important recent techniques polymorphism, which makes uses code encryption, metamorphism, variety obfuscation techniques. This dissertation presents three new for detection these malware. The first technique is recognize polymorphic malware that encrypted self-decrypt before launching the in network traffic. We propose approach combines static analysis instruction emulation more accurately identify starting location instructions decryption routine, characteristic such even if self-modifying used. method has been implemented tested on current exploits, including ones generated by state-of-the-art engines. All exploits detected (i.e., 100% rate), those routine dynamically coded self-modifying. The also benign traffic Windows executables. false positive rates approximately .0002% .01% two categories, respectively. Running time linear size payload being analyzed between 1 2 MB/s.