Disguised malware script detection system using hybrid genetic algorithm
Jinhyun Kim, Byung-Ro Moon · 2013
Malicious software, or malware for short, is one of the most serious threats to computer systems. There are various disguise techniques that hide malware from being detected, and these techniques are becoming more sophisticated. Traditional signature-based detection systems often can not cope with disguised malware timely. In this paper, we propose a new approach to detect disguised malware scripts. The proposed system consists of a metric-based detection algorithm and a hybrid genetic algorithm. We use the frequencies of token occurrences as a metric, and separate identifiers from other program tokens. The genetic algorithm tries further detection by extracting the main core of a program. Experimental tests showed that the proposed system successfully detected a number of newly generated malware scripts which existing anti-viruses missed more than half of. The system would be suitable for an offline malware detection which requires high quality.