Journal in Computer Virology

, Volume 7, Issue 3, pp 201–214

Hunting for undetectable metamorphic viruses

Original Paper

DOI: 10.1007/s11416-010-0148-y

Cite this article as:
Lin, D. & Stamp, M. J Comput Virol (2011) 7: 201. doi:10.1007/s11416-010-0148-y


Commercial anti-virus scanners are generally signature based, that is, they scan for known patterns to determine whether a file is infected. To evade signature-based detection, virus writers have employed code obfuscation techniques to create metamorphic viruses. Metamorphic viruses change their internal structure from generation to generation, which can provide an effective defense against signature-based detection. To combat metamorphic viruses, detection tools based on statistical analysis have been studied. A tool that employs hidden Markov models (HMMs) was previously developed and the results are encouraging—it has been shown that metamorphic viruses created by a reasonably strong metamorphic engine can be detected using an HMM. In this paper, we explore whether there are any exploitable weaknesses in an HMM-based detection approach. We create a highly metamorphic virus-generating tool designed specifically to evade HMM-based detection. We then test our engine, showing that we can generate metamorphic copies that cannot be detected using existing HMM-based detection techniques.

Copyright information

© Springer-Verlag France 2010

Authors and Affiliations

  1. 1.Cisco Systems, Inc.San JoseUSA
  2. 2.Department of Computer ScienceSan Jose State UniversitySan JoseUSA

Personalised recommendations