Metamorphic malware identification using engine-specific patterns based on co-opcode graphs

Basit Öğe Kaydı
dc.contributor.authorKakisim, Arzu Gorgulu
dc.contributor.authorNar, Mert
dc.contributor.authorSogukpinar, Ibrahim
dc.date.accessioned2021-01-25T21:47:59Z
dc.date.available2021-01-25T21:47:59Z
dc.date.issued2020
dc.departmentİstanbul Ticaret Üniversitesien_US
dc.description.abstractA metamorphic virus is a type of malware that modifies its code using a morphing engine. Morphing engines are used to generate a large number of metamorphic malware variants by performing different obfuscation techniques. Since each metamorphic malware has its own unique structure, signature based anti-virus programs are ineffective to detect these metamorphic variants. Therefore, detection of these kind of viruses becomes an increasingly important task. Recently, many researchers have focused on extracting common patterns of metamorphic variants that can be used as micro-signatures to identify the metamorphic malware executables. With the similar motivation, in this work, we propose a novel metamorphic malware identification method, named HLES-MMI (Higher-level Engine Signature based Metamorphic Malware Identification). The proposed method firstly constructs a unique graph structure, called as co-opcode graph, for each metamorphic family, then extracts engine-specific opcode patterns from the graphs. Finally, it generates higher-level signature belonging to each family by representing the extracted opcode-patterns with a binary vector. Experimental results on four datasets produced by different morphing engines demonstrate the effectiveness and efficiency of the proposed method by comparing with several existing malware identification methods.en_US
dc.description.sponsorshipScientific and Technological Research Council of Turkey (TUBITAK)Turkiye Bilimsel ve Teknolojik Arastirma Kurumu (TUBITAK) [ARDEB-116E624]en_US
dc.description.sponsorshipThis work was supported by the Scientific and Technological Research Council of Turkey (TUBITAK), Grant No: ARDEB-116E624.en_US
dc.identifier.doi10.1016/j.csi.2020.103443en_US
dc.identifier.issn0920-5489
dc.identifier.issn1872-7018
dc.identifier.scopus2-s2.0-85083035434en_US
dc.identifier.scopusqualityQ1en_US
dc.identifier.urihttps://doi.org/10.1016/j.csi.2020.103443
dc.identifier.urihttps://hdl.handle.net/11467/4474
dc.identifier.volume71en_US
dc.identifier.wosWOS:000535159300005en_US
dc.identifier.wosqualityQ2en_US
dc.indekslendigikaynakWeb of Scienceen_US
dc.indekslendigikaynakScopusen_US
dc.language.isoenen_US
dc.publisherELSEVIERen_US
dc.relation.ispartofCOMPUTER STANDARDS & INTERFACESen_US
dc.relation.publicationcategoryMakale - Uluslararası Hakemli Dergi - Kurum Öğretim Elemanıen_US
dc.rightsinfo:eu-repo/semantics/closedAccessen_US
dc.subjectMetamorphic malwareen_US
dc.subjectMalware detectionen_US
dc.subjectOpcode graphen_US
dc.subjectVirus generation kitsen_US
dc.subjectStatic analysisen_US
dc.titleMetamorphic malware identification using engine-specific patterns based on co-opcode graphsen_US
dc.typeArticleen_US

Dosyalar

Koleksiyon

WoS İndeksli Yayınlar Koleksiyonu
Scopus İndeksli Yayınlar Koleksiyonu