Profile hidden Markov models and metamorphic virus detection

被引：52

作者：

Attaluri, Srilatha ^{[1
]}

McGhee, Scott ^{[1
]}

Stamp, Mark ^{[1
]}

机构：

[1] San Jose State Univ, Dept Comp Sci, San Jose, CA 95192 USA

来源：

JOURNAL IN COMPUTER VIROLOGY AND HACKING TECHNIQUES | 2009年 / 5卷 / 02期

关键词：

D O I：

10.1007/s11416-008-0105-1

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

Metamorphic computer viruses "mutate" by changing their internal structure and, consequently, different instances of the same virus may not exhibit a common signature. With the advent of construction kits, it is easy to generate metamorphic strains of a given virus. In contrast to standard hidden Markov models (HMMs), profile hidden Markov models (PHMMs) explicitly account for positional information. In principle, this positional information could yield stronger models for virus detection. However, there are many practical difficulties that arise when using PHMMs, as compared to standard HMMs. PHMMs are widely used in bioinformatics. For example, PHMMs are the most effective tool yet developed for finding family related DNA sequences. In this paper, we consider the utility of PHMMs for detecting metamorphic virus variants generated from virus construction kits. PHMMs are generated for each construction kit under consideration and the resulting models are used to score virus and non-virus files. Our results are encouraging, but several problems must be resolved for the technique to be truly practical.

引用

页码：151 / 169

页数：19

共 32 条

[21]

Mount D. W., 2001, BIOINFORMATICS SEQUE

[22]

Munro J., 2002, ANTIVIRUS RES DETECT

[23]

Orr, 2006, VIRAL DARWINISM W32

[24]

Orr, 2007, MOL VIROLOGY LEXOTAN

[25]

Polk W. T., 1995, ANTIVIRUS TOOLS TECH

[26] A TUTORIAL ON HIDDEN MARKOV-MODELS AND SELECTED APPLICATIONS IN SPEECH RECOGNITION [J].

RABINER, LR .

PROCEEDINGS OF THE IEEE, 1989, 77 (02) :257-286

[27]

STAMP M, 2004, REVEALING INTRO HIDD

[28]

Stamp M., 2005, INFORM SECURITY PRIN

[29]

Szor P., 2005, ART COMPUTER VIRUS D

[30]

Walenstein A, 2006, SIXTH IEEE INTERNATIONAL WORKSHOP ON SOURCE CODE ANALYSIS AND MANIPULATION, PROCEEDINGS, P75

← 1 2 3 4 →