A Novel Malware Variants Detection Method Based On Function-call Graph

摘要：

Code obfuscation plays a significant role in metamorphic malware. Moreover, identifying a metamorphic malware variant is a challenge task, because its obfuscation engine can easily generate various variants with different forms while maintaining the same functionality to escape detection. This paper presents a novel approach to recognize metamorphic malware based on programs function-calf graphs. Graph-coloring and cosine similarity techniques are used to measure the similarity of two programs on the basis of functioncall graph. Experimental results have shown that the proposed method can accurately detect the metamorphic malware variants.

关键词： malware graph-coloring function-matching

作者: Lingfei Wu Ming Xu Jian Xu Ning Zheng Haiping Zhang

作者单位: Institute of Computer Application Technology Hangzhou Dianzi University Hangzhou, China, 310018

会议类型: 国际会议

会议名称: The 13th IEEE Joint International Computer Science and Information Technology Conference(2011年第13届IEEE联合国际计算机科学与信息技术会议 JICSIT 2011)

会议地点: 重庆

会议语种:英文

页码: 828-832

在线出版日期: 2011-08-20（万方平台首次上网日期，不代表论文的发表时间）