The use of tools and techniques to detect polymorphic malware can be compared to the classic predator-prey model. The Lotka-Volterra model ("predator-prey" model) describes a population consisting of two species that interact with each other. Victims die out at a rate equal to the number of encounters between predators and prey, which is proportional to the size of both populations. Predators reproduce at a rate that is proportional to the amount of prey eaten by the predators. The system of equations that describes such a population is called the Lotka-Volterra model. According to the conditions of the model, the victims eat the plants, and the predators eat the victims. We will use this model to simulate the process of detecting polymorphic malware. Polymorphic viruses in a computer system will act as a "victim", tools and methods for detecting polymorphic malware will act as a "predator".
The problem of detecting malicious software is quite relevant and a significant amount of research by scientists is devoted to it.
The work [1] reflects a comprehensive modern review of research on the malware detection model.
The paper [2] proposes an intelligent agent system for detecting DDoS attacks using automatic feature selection and selection.
In [3], it is stated that detection of malicious traffic in computer systems and improvement of security of computer networks is possible using the results of analysis and detection of malicious programs using machine learning algorithms to calculate the difference in correlation symmetry.
The use of machine learning is also proposed in [15].
The study [4] proposed an approach that takes advantage of the deep transfer methodology and includes a fine-tuning method and various combination strategies to improve detection and classification performance without the need to develop training models from scratch.
In [6], malicious software is detected with the help of convolutional neural networks (CNN), in [9] with the help of machine learning algorithms.
The work [10] compares the methods of detecting malicious programs based on static, dynamic and hybrid analysis.
In work [12] proposes a new systematic approach to identifying modern malware using dynamic deep learning-based methods combined with heuristic approaches to classify and detect five modern malware families: adware, Radware, rootkit, SMS malware, and ransomware.
The work [13] proposes an integrated framework for implementing IoT with blockchain technology to guarantee high level of security and validation process based on the integration between consensus algorithms of blockchain (PBFT and Tangle).
In [14], a conceptual model of multi-computer systems was developed, which is designed to ensure the functioning of anti-virus baits and traps for detecting malicious programs.
In works [17,18] proposed a novel detection approach by generating structural features through computing a stream of byte chunks using compression ratio, entropy, Jaccard similarity coefficient and Chi-square statistic test.
The paper [20] presents an approach to the detection of metamorphic viruses based on the analysis of its obfuscation features.
In [21], the K-NN algorithm was used to detect malicious software. In [22], a support vector machine (SVM) model was used to detect malicious software. Dynamic Malware Analysis with Reinforcement Learning was carried out in [24].
In [25], a method for determining the effectiveness of a distributed system for detecting anomalous manifestations is proposed. In work [26], a method for detecting unknown metamorphic viruses is proposed, which is based on the analysis of potentially suspicious behavior of programs on the host, and in work [27] -a method for detecting metamorphic viruses, based on the search for equivalent functional blocks.
The paper [28] addresses the challenges associated with App-DDoS detection and presents a highly effective and adaptable solution for detecting various types of App-DDoS attacks.
So, you can see quite a wide selection of methods for detecting malware. One of these models is also the Lotka-Volterra model ("predator-prey" model) [5,23], which has found wide use in various areas of our life: in space research [7], biology [8,11], in many in the fields of engineering [16], medicine [19], security assessment of cyber-physical systems [29]. However, the use of this model for researching the process of identifying polymorphic software is quite appropriate and relevant, which is why this study is devoted to it.
Consider the classic Lotka-Voltaire model and its adaptation to the process of detecting polymorphic malware.
In general, the model of interspecific competition looks as follows:
where x is the number of victims; y is the number of predators; t -time; α, β, γ, δ are coefficients that reflect the interaction between species.
In the case of adaptation of the model to simulate the polymorphic malware detection process, α, β, γ, δ can display the following: α is the probability that the number of polymorphic viruses will increase; β is the probability that polymorphic viruses of different levels of complexity will be detected using the selected methods, technologies and tools; γ is the probability that some of the selected methods, technologies and tools will not be effective in detecting polymorphic viruses of different levels of complexity as a result of the appearance of new varieties; δ is the probability that polymorphic viruses of different levels of complexity will require the complex use of selected methods, technologies and tools, as well as the latest approaches; x -quantitative measurement of polymorphic viruses at time t; y is a quantitative measure of the available technologies, methods and tools for detecting polymorphic viruses at time t. It immediately follows from the system that if there are no polymorphic viruses (x = 0), then the number of necessary methods, technologies and tools for their detection will decrease exponentially with a certain initial coefficient (γ according to formula 1).
A similar situation is obtained in the complete absence of methods, technologies and tools for detecting polymorphic viruses (y = 0):
This equation ( 3) is sometimes called the Malthus equation. Therefore, the growth of polymorphic viruses is exponential with a certain, predetermined constant (α).
It is worth noting that the Lotka-Volterra model makes several assumptions:
1. There is a constant appearance of polymorphic viruses.
2. Polymorphic viruses, as well as their detection technologies, are in the computer system. 3. Only the presence of polymorphic viruses and their detection technologies in the computer system is taken into account.
Let's find special points possessed by the system:
It is clear that when x (0) = 0, y (0) = 0, the special point will be precisely (0, 0), but this case is not interesting, because at the zero moment of time there are no polymorphic viruses and technologies for their detection and, logically , no longer appear.
Much more interesting things happen in the nonzero case. Depending on the initial parameters, a special point will change -such a number of viruses and their detection technologies, when both indicators remain unchanged and balanced.
If the initial condition does not fall into a special point, the phase curves will be located around it, forming an infinite cyclic oscillation, which was exactly what Lotka and Volterra were talking about. That is, the number of polymorphic viruses will grow, and the number of effective methods for their detection will fall, then vice versa, and so on for an unlimited amount of time (within reasonable limits, of course).
This approach is the second stage in the proposed comprehensive approach to detection, analysis and classification of polymorphic malware (Figure 1).
Consider the implementation of the "predator-prey" model for modeling the process of detecting polymorphic malware using the Lotka-Volterra equation solver [30].
The following scale is used to denote x and y parameters (table 1). The β indicator was formed on the basis of previous studies on the effectiveness of the complex use of the above methods for detecting polymorphic malware.
Experiment 1 (2 methods were used to detect polymorphic viruses) involves the following input parameters (Figure 2, 3): α=0.2; β=0.3 (2 methods were used to detect polymorphic viruses); γ=0.7; δ=0.3; x=1; y=1; max_time = 100 (seconds); t = 1. The decrease in the number of polymorphic viruses after a certain time begins to be affected by y, and the number of polymorphic viruses reaches the value (in point expression) γ/δ=0.7/0.3=2.33, the number of methods used to detect polymorphic malware also begins to decrease along with by reducing the number of polymorphic viruses. The decrease in the number of polymorphic viruses and methods of its detection decreases until y reaches the value α/β = 0.2/0.3=0.66. At this moment, the number of polymorphic viruses begins to increase, and after a certain period of time and methods of their detection. This process is constantly repeated with a certain period.
The periodicity of the process can be clearly observed in the pictures. The number of polymorphic viruses and their detection methods fluctuates around the values of x = 2.33, y = 0.66, respectively.
The periodicity of the process is well observed on the phase curve (x(t), y(t)), which is a closed line. The extreme left point of this curve is the point at which the number of polymorphic viruses reaches its minimum value, and the extreme right point -the maximum. Between these points, the number of effective detection methods first decreases to the lower point of the phase curve and then increases to the upper point of the phase curve. The phase curve covers the point x = 2.33 and y = 0.66. At this point, the system has a stationary state (dx/dt=0, dy/dt=0). If at the initial moment the system was at this point, then over time x(t) and y(t) will not change and will remain constant, in all other cases an oscillatory process will be observed. Based on these initial values, the maximum value of polymorphic malware detection methods (in terms of points) will be 2.33 points.
It can be seen that the selected virus detection methods are not effective and lead to the spread of viruses to the level of almost 5 points.
Experiment 2 (5 methods were used to detect polymorphic viruses) involves the following input parameters (Figure 4, 5): α=0.2; β=0.6 (5 methods were used to detect polymorphic viruses); γ=0.2; δ=0.3; x=1; y=1; max_time = 100 (seconds); t = 1. It can be seen that these virus detection methods (5) are effective and lead to a spread of viruses slightly more than 2 points.
Experiment 3 (6 methods were used to detect polymorphic viruses) involves the following input parameters (Figure 6, 7): α=0.5; β=0.9 (6 methods were used to detect polymorphic viruses); γ=0.3; δ=0.7; x=1; y=1; max_time = 100 (seconds); t = 1. The selected virus detection methods (6) are effective and result in a virus spread of slightly more than 1 point.
The study proposes the use of the Lotka-Volterra model for modeling the process of detecting polymorphic malware. It is proposed to consider α as the probability that the number of polymorphic viruses will increase; β -the probability that polymorphic viruses of different levels of complexity will be detected using the selected methods, technologies and tools; γ -the probability that some of the selected methods, technologies and tools will not be effective in detecting polymorphic viruses of different levels of complexity as a result of the appearance of new varieties; δ -the probability that polymorphic viruses of different levels of complexity will require the complex use of selected methods, technologies and tools, as well as the latest approaches; x -quantitative measurement of
polymorphic viruses at time t; y is a quantitative measure of the available technologies, methods and tools for detecting polymorphic viruses at time t. The influence of input indicators on the maximum rate of spread and detection of polymorphic viruses in its fluctuating process was studied. This approach confirms the feasibility of using a complex of 6 methods to detect polymorphic malware: string search algorithms, intelligent data analysis, sandbox analysis, machine learning, the method of developing structural functions, probabilistic logical networks.
During the preparation of this work, the authors used Grammarly in order to: grammar and spelling check; DeepL Translate in order to: some phrases translation into English. After using these tools/services, the authors reviewed and edited the content as needed and take full responsibility for the publication's content.