Journal in Computer Virology

, Volume 7, Issue 3, pp 201–214 | Cite as

Hunting for undetectable metamorphic viruses

Original Paper

Abstract

Commercial anti-virus scanners are generally signature based, that is, they scan for known patterns to determine whether a file is infected. To evade signature-based detection, virus writers have employed code obfuscation techniques to create metamorphic viruses. Metamorphic viruses change their internal structure from generation to generation, which can provide an effective defense against signature-based detection. To combat metamorphic viruses, detection tools based on statistical analysis have been studied. A tool that employs hidden Markov models (HMMs) was previously developed and the results are encouraging—it has been shown that metamorphic viruses created by a reasonably strong metamorphic engine can be detected using an HMM. In this paper, we explore whether there are any exploitable weaknesses in an HMM-based detection approach. We create a highly metamorphic virus-generating tool designed specifically to evade HMM-based detection. We then test our engine, showing that we can generate metamorphic copies that cannot be detected using existing HMM-based detection techniques.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Attaluri S., McGhee S., Stamp M.: Profile hidden Markov models and metamorphic virus detection. J. Comput. Virol. 5(2), 151–169 (2009)CrossRefGoogle Scholar
  2. 2.
    Aycock J.: Computer Viruses and Malware. Springer, Berlin (2006)Google Scholar
  3. 3.
    Bailey, M. et al.: Automated Classification and Analysis of Internet Malware, RAID 2007, LNCS 4637, pp. 178–197. Springer, Berlin (2007)Google Scholar
  4. 4.
    Caillat, B.A., Desnos, Erra, R.: BinThavro: Towards a Useful and Fast Tool for Goodware and Malware Analysis, ECIW (2010)Google Scholar
  5. 5.
    Cohen F.: Computer viruses: theory and experiments. Comput. Secur. 6(1), 22–35 (1987)CrossRefGoogle Scholar
  6. 6.
    Daoud, E., Jebril, I.: Computer virus strategies and detection methods. Int. J. Open Problems Comput. Math. 1(2). (2008). http://www.emis.de/journals/IJOPCM/files/IJOPCM(vol.1.2.3.S.08).pdf
  7. 7.
    Desai, P.: Towards an undetectable computer virus. Master’s report, Departent of Computer Science, San Jose State University. (2008). http://www.cs.sjsu.edu/faculty/stamp/students/Desai_Priti.pdf
  8. 8.
    Durbin R. et al.: Biological Sequence Analysis: Probabilistic Models of Proteins and Nucleic Acids. Cambridge University Press, Cambridge (1999)Google Scholar
  9. 9.
  10. 10.
    Filiol E., Josse S.: A statistical model for undecidable viral detection. J. Comput. Virol. 3(2), 65–74 (2007)CrossRefGoogle Scholar
  11. 11.
    Gheorghescu, M.: An automated virus classification system. In: Virus Bulletin Conference (2005)Google Scholar
  12. 12.
    Gueguen, G., Filiol, E.: New threat grammars, IAWACS (2010)Google Scholar
  13. 13.
  14. 14.
    Lin, D.: Hunting for undetectable metamorphic viruses. Master’s report, Department of Computer Science, San Jose State University (2010)Google Scholar
  15. 15.
    Mishra, P., Stamp, M.: Software uniqueness: how and why. In: Dey, P.P., Amin, M.N., Gatton, T.M. (eds.): Proceedings of Conference on Computer Science and its Applications. San Diego, July 2003. http://www.cs.sjsu.edu/~stamp/cv/papers/iccsaPuneet.doc
  16. 16.
    Rabiner, L.R.: A tutorial on hidden Markov models and selected applications in speech recognition. Proc. IEEE 77(2) (1989)Google Scholar
  17. 17.
    Stamp, M.: A revealing introduction to hidden Markov models, January 2004. http://www.cs.sjsu.edu/faculty/stamp/RUA/HMM.pdf
  18. 18.
    Stamp M.: Information Security: Principles and Practice. Wiley, New York (2005)CrossRefGoogle Scholar
  19. 19.
    Szor, P., Ferrie, P.: Hunting for Metamorphic. Symantec Press, Cupertino. (2005). http://www.symantec.com/avcenter/reference/hunting.for.metamorphic.pdf
  20. 20.
    Venkatachalam, S.: Detecting undetectable computer viruses. Master’s report, Department of Computer Science, San Jose State University (2010). http://www.cs.sjsu.edu/faculty/stamp/students/venkatachalam_sujandharan.pdf
  21. 21.
    Walenstein, A., et al: The design space of metamorphic malware. In: Proceedings of the 2nd International Conference on Information Warfare, March 2007Google Scholar
  22. 22.
    Wong W., Stamp M.: Hunting for metamorphic engines. J. Comput. Virol. 2(3), 211–229 (2006)CrossRefGoogle Scholar
  23. 23.
    Zbitskiy P.: Code mutation techniques by means of formal grammars and automatons. J. Comput. Virol. 5(3), 199–207 (2009)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag France 2010

Authors and Affiliations

  1. 1.Cisco Systems, Inc.San JoseUSA
  2. 2.Department of Computer ScienceSan Jose State UniversitySan JoseUSA

Personalised recommendations