From the Design of a Generic Metamorphic Engine to a Black-Box Classification of Antivirus Detection Techniques

Abstract : In this paper, we propose an original black-box approach concerning antivirus products evaluation. Contrary to classical tests focusing on detection rates concerning a specific malware sample, we use a generic metamorphic engine to observe the detection products behaviors. We believe that this point of view presents a double interest: First, it offers an original way of evaluating current antivirus products focusing on the observed detection technique. More precisely, the use of metamorphic malware guarantees the difficulty of static signature based detection techniques to focus only on heuristic and behavioral detection approaches. Second, by pointing out current detection capabilities, we practically evaluate the danger that complex metamorphic malware could represent. To achieve this goal, we start with the description of a generic metamorphic engine acting in two steps: obfuscation and modeling. Then, we apply this engine to a real mass-mailing worm and propose the resulting metamorphic malware samples to current antivirus products. The observed results lead to a classification of detection techniques in two main categories: the first one, relying on static detection techniques, presents low detection rates obtained by heuristic analysis. The second one, composed of behavioral detection programs, mainly focuses on elementary suspicious actions. In all cases, no product was able to detect a global malware behavior. Consequently, we consider that metamorphic malware detection still represents a real challenge for antivirus products. Through this study, we hope to help defenders understand and defend against the threat represented by this class of malware.
Document type :
Journal articles
Complete list of metadatas

https://hal-supelec.archives-ouvertes.fr/hal-00464807
Contributor : Myriam Andrieux <>
Submitted on : Thursday, March 18, 2010 - 9:29:26 AM
Last modification on : Thursday, March 29, 2018 - 11:06:04 AM

Links full text

Identifiers

Collections

Citation

Jean-Marie Borello, Eric Filiol, Ludovic Mé. From the Design of a Generic Metamorphic Engine to a Black-Box Classification of Antivirus Detection Techniques. Journal in Computer Virology, Springer Verlag, 2010, 6 (3), pp.NC. ⟨10.1007/s11416-009-0136-2⟩. ⟨hal-00464807⟩

Share

Metrics

Record views

337