.png){kind=icon}
返回
MSG: Missing-sequence generator for metamorphic malware detection
.png){kind=icon}
PRE
AI
DOI：10.1016/j.jisa.2024.103962.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Metamorphic malware is a sophisticated malware that frequently modifies its code to avoid being detected by signature-based methods while maintaining the same output during the run time. Invariably, the output of the register values reflects the malware's behavior. Therefore, capturing the output sequence from the register values of a binary is essential to identify the evolutionary relationship between the sequences, leading to effective malware detection. In other words, generating register value sequences for the malicious code in a binary, distinct or missing from benign binary, is vital to effectively detecting the typical and metamorphic malware. This paper proposes a novel Missing Sequence Generator (MSG) to generate features in the form of missing sequences by capturing the registers' output sequence from a binary's Control Flow Graph (CFG) with context, semantics, and control flow. We create a diverse and large-scale dataset of metamorphic malware using the metamorphic engine to conduct experiments. Also, we experiment with diverse non-metamorphic malware. The proposed model achieves an accuracy of 99.82% for the non-metamorphic dataset and 99.06% for the metamorphic dataset, with negligible False Positive Rates (FPRs). The proposed model outperforms the state-of-the-art models. Further, the proposed work proves its performance and effectiveness by surpassing 47 existing anti-malware.
Keyword:
Advanced static analysis
Metamorphic malware
Neural network (NN)
Obfuscation
Register value-set analysis (RVSA)
期刊
IF:
3.7
论文数:
1.9K
被引数:
4.9K
机构
引用论文
G3MD: Mining frequent opcode sub-graphs for metamorphic malware detection of existing familiesG3MD: 挖掘频繁的操作码子图，用于现有家族的变形恶意软件检测
PREAI
分享收藏Malware-on-the-Brain: Illuminating Malware Byte Codes With Images for Malware ClassificationMalware-on-the-Brain: 用图像照亮恶意软件字节码进行恶意软件分类
OAAI
OAAI分享收藏An entropy-based distance measure for analyzing and detecting metamorphic malware一种基于熵的变形恶意软件距离分析与检测方法.png)
APPLIED INTELLIGENCE
APPLIED INTELLIGENCEIF3.5
PREAI
分享收藏
查看更多内容