Are current antivirus programs able to detect complex metamorphic malware? An empirical evaluation.

摘要: In this paper, we present the design of a metamorphic engine representing type hurdle that antivirus systems need to get over in their ght against malware. First describe two steps en- gine replication process : obfuscation and modeling. Then, apply real worm evaluate current products detection ca- pacities. This assessment leads classication tools, based on observable behavior, main categories: rst one, rely- ing static techniques, presents low rates obtained by heuristic analysis. The second composed dynamic programs, focuses only elementary suspicious actions. Consequently, no appear reliably detect candidate malware after appli- cation engine. Through evaluation products, hope help defenders understand defend threat represented class