Cover Image

Metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model

Metamorphic malware modifies its code structure using a morphing engine to evade traditional signature-based detection. Previous research has shown the use of opcode instructions as feature representation with Hidden Markov Model in the context of metamorphic malware detection. However, it would be...

Full description

Saved in:
Bibliographic Details
Main Authors: Ling, Yeong Tyng, Mohd Sani, Nor Fazlida, Abdullah, Mohd Taufik, Abdul Hamid, Nor Asilah Wati
Format: Article
Published: Springer Cham 2021
Online Access:http://psasir.upm.edu.my/id/eprint/94169/
https://link.springer.com/article/10.1007/s11416-021-00404-z
Tags: Add Tag
No Tags, Be the first to tag this record!
id my.upm.eprints.94169
record_format eprints
spelling my.upm.eprints.941692023-03-29T01:30:43Z http://psasir.upm.edu.my/id/eprint/94169/ Metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model Ling, Yeong Tyng Mohd Sani, Nor Fazlida Abdullah, Mohd Taufik Abdul Hamid, Nor Asilah Wati Metamorphic malware modifies its code structure using a morphing engine to evade traditional signature-based detection. Previous research has shown the use of opcode instructions as feature representation with Hidden Markov Model in the context of metamorphic malware detection. However, it would be more feasible to extract a file feature at fine-grained level. In this paper, we propose a novel detection approach by generating structural features through computing a stream of byte chunks using compression ratio, entropy, Jaccard similarity coefficient and Chi-square statistic test. Nonnegative Matrix Factorization is also considered to reduce the feature dimensions. We then use the coefficient vectors from the reduced space to train Hidden Markov Model. Experimental results show there is different performance between malware detection and classification among the proposed structural features. Springer Cham 2021-10-31 Article PeerReviewed Ling, Yeong Tyng and Mohd Sani, Nor Fazlida and Abdullah, Mohd Taufik and Abdul Hamid, Nor Asilah Wati (2021) Metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model. Journal of Computer Virology and Hacking Techniques, 18. pp. 183-203. ISSN 2263-8733 https://link.springer.com/article/10.1007/s11416-021-00404-z 10.1007/s11416-021-00404-z
institution Universiti Putra Malaysia
building UPM Library
collection Institutional Repository
continent Asia
country Malaysia
content_provider Universiti Putra Malaysia
content_source UPM Institutional Repository
url_provider http://psasir.upm.edu.my/
description Metamorphic malware modifies its code structure using a morphing engine to evade traditional signature-based detection. Previous research has shown the use of opcode instructions as feature representation with Hidden Markov Model in the context of metamorphic malware detection. However, it would be more feasible to extract a file feature at fine-grained level. In this paper, we propose a novel detection approach by generating structural features through computing a stream of byte chunks using compression ratio, entropy, Jaccard similarity coefficient and Chi-square statistic test. Nonnegative Matrix Factorization is also considered to reduce the feature dimensions. We then use the coefficient vectors from the reduced space to train Hidden Markov Model. Experimental results show there is different performance between malware detection and classification among the proposed structural features.
format Article
author Ling, Yeong Tyng
Mohd Sani, Nor Fazlida
Abdullah, Mohd Taufik
Abdul Hamid, Nor Asilah Wati
spellingShingle Ling, Yeong Tyng
Mohd Sani, Nor Fazlida
Abdullah, Mohd Taufik
Abdul Hamid, Nor Asilah Wati
Metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model
author_facet Ling, Yeong Tyng
Mohd Sani, Nor Fazlida
Abdullah, Mohd Taufik
Abdul Hamid, Nor Asilah Wati
author_sort Ling, Yeong Tyng
title Metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model
title_short Metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model
title_full Metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model
title_fullStr Metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model
title_full_unstemmed Metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model
title_sort metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model
publisher Springer Cham
publishDate 2021
url http://psasir.upm.edu.my/id/eprint/94169/
https://link.springer.com/article/10.1007/s11416-021-00404-z
_version_ 1761673197037551616
score 13.211869

Similar Items