The Technique for Metamorphic Viruses’ Detection Based on Its Obfuscation Features Analysis
George Markowsky, Олег Савенко, Sergii Lysenko, Andrii Nicheporuk · 2017
The paper presents an approach for the metamorphic viruses detec- tion based on its obfuscation features analysis. The obfuscation features were obtained on the basis of the equivalent functional block search in the suspicious program and its modified version. The results of the research demonstrated that the efficiency of metamorphic viruses detection based on the proposed obfusca- tion quantitative features depends on the choice of the similarity metric at the stages of the search and the choice refinement of the equivalent functional blocks. The adequate choice of similarity metrics at both stages allowed in- creasing the detection efficiency of the metamorphic viruses.