Metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model
Metamorphic malware modifies its code structure using a morphing engine to evade traditional signature-based detection. Previous research has shown the use of opcode instructions as feature representation with Hidden Markov Model in the context of metamorphic malware detection. However, it would b...
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Springer
2021
|
| Subjects: | |
| Online Access: | http://ir.unimas.my/id/eprint/37348/1/Ling%20Yeong%20Tyng.pdf http://ir.unimas.my/id/eprint/37348/ |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| Institution: | Universiti Malaysia Sarawak |
| Language: | English |
| Summary: | Metamorphic malware modifies its code structure using a morphing engine to evade traditional signature-based detection.
Previous research has shown the use of opcode instructions as feature representation with Hidden Markov Model in the context
of metamorphic malware detection. However, it would be more feasible to extract a file feature at fine-grained level. In this
paper, we propose a novel detection approach by generating structural features through computing a stream of byte chunks
using compression ratio, entropy, Jaccard similarity coefficient and Chi-square statistic test. Nonnegative Matrix Factorization
is also considered to reduce the feature dimensions. We then use the coefficient vectors from the reduced space to train Hidden
Markov Model. Experimental results show there is different performance between malware detection and classification among
the proposed structural features. |
|---|