The paper presents an approach for the metamorphic viruses detection based on its obfuscation features analysis. The obfuscation features were obtained on the basis of the equivalent functional block search in the suspicious program and its modified version. The results of the research demonstrated that the efficiency of metamorphic viruses detection based on the proposed obfuscation quantitative features depends on the choice of the similarity metric at the stages of the search and the choice refinement of the equivalent functional blocks. The adequate choice of similarity metrics at both stages allowed increasing the detection efficiency of the metamorphic viruses.
Today the problem of cyber security is very important. The malware detection is a
very important task because of the information pilfering, anonymous access to
network, spy actions, spamming are observed. The most hard to detect type of the
malware is metamorphic viruses [
An article [
Another line of research of the metamorphic viruses’ detection is the opcodes
analysis [
In [
Another approaches are based on the analysis of the opcodes, that describe the key
features of the metamorphic viruses. Thus, in [
To process the received characteristic features and to make decision about the of a
metamorphic viruses presence, the machine learning methods, such as J48,
multiagent approaches, neural networks, design tree, k-nearest neighbors algorithm and
Naive Bayes [
An alternative approach for the metamorphic viruses detection is the features
extraction, based on the control flow analysis. In [
The main drawbacks of the mentioned techniques are low level of the detection, the complexity and high rate of false positives. The way to eliminate these disadvantages is involvement of the obfuscation features analysis, based on the assessment of the quantitative characteristics of the metamorphic viruses’ code modification. 3
The paper [
The technique involves the following stages: a data preprocessing; a localization of a place for the search of the equivalent function blocks (EFBs) in the executable; a search of the EFBs, the choice refinement of the EFBs; the obtaining of the quantitative features of the code obfuscation, based on the comparison of EFBs of suspicious program and its modified version; a drawing the conclusion about metamorphic viruses presence (Fig. 1). Let us take a closer look at each step of the technique.
In order to detect metamorphic viruses the main stage is the obfuscation features extraction. We will deal with quantitative features of the code obfuscation, which will allow estimating the difference between two copies of the metamorphic virus. For this purpose a disassembly of the suspicious program and the obtaining of a code sample before the emulation are performed. In order to create the modified version of the suspicious program it is launched in the emulator. A result of the data preprocessing stage are two opcodes lists of the suspicious program and its modified version. 3.2
The features extraction of the metamorphic viruses requires the localization of a place for the search of the EFBs in the executable. For this purpose the definition of the program’s entry point and the choice of the section where it is located are carried out. We will choose the localization of a place for the search of the EFBs in such cases: if there are call or jump instructions near the program’s entry point and the operands contain the address of another section; there is a section with non-standard name; there is an executable access attribute of the section. 3.3
After the place of the search for the EFBs of the suspicious program and its modified version is determined, the next stage involves the partitioning of the opcode listings into the blocks. The process of the partitioning of the opcode listings into the functional blocks (FBs) involves the disassembly of the suspicious program and its modified version, and the separation of the opcode sequences, arranged between the commands of conditional or unconditional jumps.
Let us denote the suspicious program as Fb and its modified version Fa as the sets Fb {Fb1 , Fb2 ,...,Fbm } and Fa {Fa1 , Fa2 ,...,Fan } accordingly. To present the obtained FBs as a statistical model, the rating matrix of the opcodes appearance for each FBs was construct. For this purpose, to each functional block the Term Frequency–Inverse Document Frequency (TF-IDF) statistical metric was applied: s
ni n k i * log(
N 1.0 n j ) where ni – a number of і-th appearance of the opcode in the functional block F ; k 1, ka – a number of opcodes in the functional block, where ka – a total number of the assembler instructions; n j – a number of functional blocks with some opcode ni ; N – a total number of the functional blocks.
Then, the rating matrices of the opcodes appearance in the FBs of the suspicious program Fb and its modified version Fa can be presented as follows: Fa1 s11 Fa2 s12 Fa ... ...
Fan s1n s21 ... sk1 s22 ... sk 2 ... ... ...
s2n ... skn Fb1 s11 Fb2 s12 Fb ... ...
Fbm s1m s21
... sg1 s22 ... sg 2 ... ... ... s2m ... sgm
Thus, as a result the two sets of FBs are obtained, which are represented as the rating matrices of the opcodes appearance in function blocks for the suspicious program and its modified version. The search of the EFBs involves a pairwise comparison of each FB from the set Fb with each FB from Fa using the similarity metric. The result of the comparison the similarity score Er between the two FB is obtained. If the value of the similarity score Er for two FBs is less than the specified threshold , then the recalculation of similarity score between the functional block of the program and the next block that follows the block is performed. The above actions are repeated until the value of the similarity score is less or equal to the threshold . The threshold value is determined experimentally.
Thus, at the stage of determination of the equivalent functional blocks, there may be a situation when the several function blocks may correspond to one FBs Fbi ~ {Fa j | Er (Fbi , Fa j ) , j 1, q}, where q – a number of the FB from the set (1) (2) Fa , equivalent to FB Fbi , – a similarity threshold for two functional blocks. Therefore, in order to eliminate the uncertainty and to define the equivalent FBs unambiguously, the choice refinement of the EFBs is to be performed. 3.4
In order to perform the choice refinement of EFBs, a probability matrix for the opcodes sequence of the functional blocks, which are defined as equivalent, is built. The columns and the rows of the matrix determine the opcodes that are present in the function block. Each cell of the matrix consists the ratio of the number of the opcodes pair appearance to the total number the opcodes in the row.
The procedure of the choice refinement of the EFBs involves the comparison of the probability matrices for the opcodes sequence of each functional blocks Fb with the each FB from the set Fa , which are equivalent to Fbi , and the choice of the minimum value of the similarity score E p : min( E p (Fbi , Fa1 ),...,E p (Fbi , Faq )) Fbi ~ Fa j .
The similarity score is evaluated using the similarity metric. In order to evaluate the quantitative features of the code obfuscation, the comparison of the obtained pairs of the EFBs using the metric of Damerau-Levenshtein is carried out. As a result, the following quantitative obfuscation features are obtained: the Damerau-Levenstein distance, the number of insertion, deletion, transposition and the matches of opcodes.
Drawing the conclusion about the similarity degree of suspicious program to the
metamorphic virus, based on the obtained features, is performed by the means of the
fuzzy inference system [
The approach demonstrated the efficiency of the metamorphic viruses detection at the rate of 79%. The main reason of such low detection rate is the wrong choice of the EFBs during the search of the EFBS and its choice refinement. To achieve the better result of the proposed approach is to correctly choose the similarity metric. 4
According to the approach described in section 3, the obtaining of the obfuscation quantitative features deals with the determining of the equivalent functional blocks in the suspicious program and its modified version. It is implemented using the similarity metrics. Thus, the main interest of the research is to investigate the impact of involvement of the similarity metrics for the right choice of the equivalent functional blocks for comparison and the correctly (at two stages of the search of the EFBs and the choice refinement of the EFBs).
In order to implement the metamorphic viruses’ detection efficiently the analysis of the quantitative features of the code obfuscation was performed. For this purpose a number of experiments were conducted. As a test data 540 samples of the metamorphic viruses using the NGVCK, VCL32 and G2 metamorphic generators were generm1 Er (Fa , Fb ) E p (Fa , Fb ) m2 Er (Fa , Fb ) E p (Fa , Fb ) m3 Er (Fa , Fb ) E p (Fa , Fb ) m4 Er (Fa , Fb ) E p (Fa , Fb ) max(| Fai Fb j |) max(m,n)
i1, j 1
(Fai Fb j )2 max(m,n)
i1, j 1
(Fai Fb j )2 max(m,n)
| Fai Fb j |
i1, j 1
(3)
(4)
(5)
(6)
(7)
ated (VX Heavens). The entire study process was conducted in the modified emulator
environment [
In [
i1, j 1 | Fai Fb j |r with r=3 where, m and n – the numbers of the EFBs in the suspicious program Fb , and its modified version Fb , respectively.
The best results of the NGVCK samples’ detection were succeeded applying the conditions: usage of the taxicab metric at the stage of the EFBs search with the value of the similarity metric threshold 0,6 ; usage of the Chebyshev metric at the stage of the choice refinement of the EFBs (detection efficiency - 94%, false positives 4% ).
The best detection results of the VCL32 samples’ were achieved applying the conditions: usage of the squared Euclidean metric at the stage of the EFBs search with the value of threshold 0,6 ; usage of the Chebyshev metric at the stage of the choice refinement of the EFBs (detection efficiency - 98%, false positives 3% ). In addition, the best results for the G2 samples’ detection were succeeded applying the conditions: usage of the taxicab metric at the stage of the EFBs search with the value of the similarity metric threshold 0,6 ; usage of the Chebyshev metric at the stage of the choice refinement of the EFBs (detection efficiency - 100%, false positives 2% ). The experimental results are presented in figure 2. It should be noted, that the decreasing of the similarity metric threshold value leads to the increasing of the number of EFBs.
a) e) f)
Fig. 2. Efficiency of the metamorphic viruses detection and false positives rates FPR for the NGVCK (a), VCL32 (c), G2 (e); the dependency of the equivalent functional blocks number on the value of the similarity threshold ; the dependency of detection efficiency on the metric selection mi for the NGVCK (b), VCL32 (d), G2 (f) 5
The paper presents an approach for the metamorphic viruses detection based on its obfuscation features analysis. The obfuscation features were obtained on the basis of the equivalent functional blocks search in the suspicious program and its modified version. As a result of the comparison, the following quantitative obfuscation features are obtained: the Damaerau-Levenstein distance, the number of insertion, deletion, transposition and the matches of opcodes.
The experiments results demonstrated that the detection efficiency depends on the choice of the similarity metrics at the stages of the search and the choice refinement of the equivalent functional blocks. The best results of the metamorphic virus detection were achieved with usage of the taxicab metric at the stage of the EFBs search and the Chebyshev metric at the stage of the choice refinement of the EFBs. It allowed increasing efficiency from 79% to 94% in comparison with the previous research.