基于操作码统计特征的可移植可执行文件变形病毒检测
Metamorphic Virus Detection in Portable Executables Using Opcodes Statistical Feature
摘要：
变形病毒采用不同的突变技术来逃避基于字符串签名的扫描。他们试图在新的后代中改变他们的代码，以便变体看起来不相似，并且没有共同的字符串序列作为签名。然而，变形病毒的所有版本都具有类似的任务和性能。这种模糊处理有助于使它们免受基于字符串的签名检测。在这项研究中，我们利用指令统计特征来比较可能被两种变异形式的特定变形病毒占据的两个托管文件的相似性。本文介绍的解决方案是依靠静态分析，并采用在不同的混淆病毒的情况下，机器操作码的频率直方图。我们使用Minkowski形式的直方图距离测量，以检查便携式可执行文件（PE）的相似性。本研究的目的是提出一个想法，对于一些特殊的混淆方法，所提出的解决方案可以用来识别变形的文件副本。因此，它可以应用于防病毒扫描程序来识别变形病毒的不同版本。
英文摘要：
Metamorphic viruses engage different mutation techniques to escape from string signature based scanning. They try to change their code in new offspring so that the variants appear non-similar and have no common sequences of string as signature. However, all versions of a metamorphic virus have similar task and performance. This obfuscation process helps to keep them safe from the string based signature detection. In this study, we make use of instructions statistical features to compare the similarity of two hosted files probably occupied by two mutated forms of a specific metamorphic virus. The introduced solution in this paper is relied on static analysis and employs the frequency histogram of machine opcodes in different instances of obfuscated viruses. We use Minkowski-form histogram distance measurements in order to check the likeness of portable executables (PE). The purpose of this research is to present an idea that for a number of special obfuscation approaches the presented solution can be used to identify morphed copies of a file. Thus, it can be applied by antivirus scanner to recognize different versions of a metamorphic virus.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
