基于特征病毒的变形病毒识别
Towards Metamorphic Virus Recognition Using Eigenviruses
摘要：
变形病毒被认为是所有计算机病毒中最危险的。与其他可以使用静态签名技术或使用模拟器动态检测的计算机病毒不同，变形病毒改变其代码以避免此类检测技术。这使得变形病毒成为计算机安全研究人员面临的真正挑战。在这篇论文中，我们研究了变形病毒用来改变其代码的技术，例如简单代码插入、指令替换、子程序置换和寄存器重命名。深入调查目前用于检测这种病毒的技术。我们讨论了商业反病毒产品使用的技术，以及科学研究中引入的技术。在此基础上，提出了一种基于无监督机器学习和人脸识别中常用的特征脸技术的变形病毒识别方法。我们分析了所提出的技术的性能，并显示了实验结果相比，知名的反病毒引擎的结果。最后，我们讨论了未来和潜在的增强所提出的方法来检测更多和其他目标病毒。
英文摘要：
Metamorphic viruses are considered the most dangerous of all computer viruses. Unlike other computer viruses that can be detected statically using static signature technique or dynamically using emulators, metamorphic viruses change their code to avoid such detection techniques. This makes metamorphic viruses a real challenge for computer security researchers. In this thesis, we investigate the techniques used by metamorphic viruses to alter their code, such as trivial code insertion, instructions substitution, subroutines permutation and register renaming. An in-depth survey of the current techniques used for detection of this kind of viruses is presented. We discuss techniques that are used by commercial antivirus products, and those introduced in scientific researches. Moreover, a novel approach is then introduced for metamorphic virus recognition based on unsupervised machine learning generally and Eigenfaces technique specifically which is widely used for face recognition. We analyze the performance of the proposed technique and show the experimental results compared to results of well-known antivirus engines. Finally, we discuss the future and potential enhancements of the proposed approach to detect more and other target viruses.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
