Metamorphic viruses detection by hidden Markov models
Fereidoon Rezaei, M. Hamedi-Hamzehkolaie, Saeid Rezaei, Ali Payandeh · 2014
Since finding and extracting a fixed signature for metamorphic viruses is hard due to the fact that, their shape changes frequently. Virus writers by using obfuscation methods make their viruses undetectable, in order to disable anti viruses to detect them easily, which ends in metamorphic viruses. We used hidden Markov model to propose the Detection Sphere method. We used three elements of a string occurrence probability, specifically-located character occurrence probability, and the amount of virus similarity to a family of viruses. The 94% detection rate result is magnificent in contrary to other anti-viruses which are less than 30%. More research and investment in multi-factor methods in hidden Markov model are recommended to detect viruses and malwares.