Classification and detection of metamorphic malware using value set analysis

Felix Leder, Bastian Steinbock, Peter Martini
2009 2009 4th International Conference on Malicious and Unwanted Software (MALWARE)  
Metamorphic malware changes the structure of its code from infection to infection. This makes it very hard to classify or to detect. While the byte-sequence of two variants may be completely different, the core functionality of the malware has to stay the same. This includes the use of flags and constants that have to be consistent at specific points. We present a novel approach that allows us to detect metamorphic variants. Based on this detection, it is also possible to classify new samples
more » ... a metamorphic family. Our approach identifies variants by tracking the use of consistent values throughout the malware. Our evaluation shows a 100% detection rate with 0 false positives for all metamorphic samples that do not change their behavior.
doi:10.1109/malware.2009.5403019 dblp:conf/malware/LederSM09 fatcat:2slzikex3vgo7oznu24qundtde