Universiti Teknologi Malaysia Institutional Repository

Metamorphic malware detection based on support vector machine classification of malware sub-signatures

Khammas, Ban Mohammed and Monemi, Alireza and Ismail, Ismahani and Mohd. Nor, Sulaiman and Marsono, Muhammad Nadzir (2016) Metamorphic malware detection based on support vector machine classification of malware sub-signatures. Telkomnika (Telecommunication Computing Electronics and Control), 14 (3). pp. 1157-1165. ISSN 1693-6930

[img]
Preview
PDF
418kB

Official URL: https://www.scopus.com/inward/record.uri?eid=2-s2....

Abstract

Achieving accurate and efficient metamorphic malware detection remains a challenge. Metamorphic malware is able to mutate and alter its code structure in each infection that can circumvent signature matching detection. However, some vital functionalities and code segments remain unchanged between mutations. We exploit these unchanged features by the mean of classification using Support Vector Machine (SVM). N-gram features are extracted directly from malware binaries to avoid disassembly, which these features are then masked with the extracted known malware signature n-grams. These masked features reduce the number of selected n-gram features considerably. Our method is capable to accurately detect metamorphic malware with ~99 accuracy and low false positive rate. The proposed method is also superior to commercially available anti-viruses for detecting metamorphic malware.

Item Type:Article
Uncontrolled Keywords:Computer crime, Support vector machines, Viruses, False positive rates, Metamorphic, Metamorphic malware, N-grams, Signature-matching, Snort, Support vector machine classification, SVM classification, Malware
Subjects:T Technology > TK Electrical engineering. Electronics Nuclear engineering
Divisions:Electrical Engineering
ID Code:71495
Deposited By: Siti Nor Hashidah Zakaria
Deposited On:22 Nov 2017 12:07
Last Modified:22 Nov 2017 12:07

Repository Staff Only: item control page