Similarity Tests for Metamorphic Virus Detection

Commercial anti-virus scanners are generally signature based, that is, they scan for known patterns to determine whether a file is infected. To evade signature-based detection, virus writers have employed code obfuscation techniques to create metamorphic viruses. Metamorphic viruses change their internal structure from generation to generation, which can provide an effective defense against signature-based detection. To combat metamorphic viruses, detection tools based on statistical analysis have been studied. A tool that employs hidden Markov models (HMMs) was previously developed and the results are encouraging--it has been shown that metamorphic viruses created by a reasonably strong metamorphic engine can be detected using an HMM. In this paper, we explore whether there are any exploitable weaknesses in an HMM-based detection approach. We create a highly metamorphic virus-generating tool designed specifically to evade HMM-based detection. We then test our engine, showing that we can generate metamorphic copies that cannot be detected using existing HMM-based detection techniques.

Virus writers and anti-virus researches generally agree that metamorphism is the way to generate undetectable viruses. Several virus writers have released virus creation kits and claimed that they possess the ability to automatically produce morphed virus variants that look substantially different from one another. To see how effective these code morphing engines are, and how much difference exists between variants of a same virus, we measured the similarity between virus variants generated by four virus generators downloaded from the Internet. Our result shows that the effectiveness of these generators varies widely. While the best generator, NGVCK, is able to create viruses that share only a few percent of similarities, the other generators produce viruses that are over 60% similar, on average. In addition, our similarity graphs show that some of these variant pairs have long segments of identical assembly opcodes at identical positions of the virus files. Compared to random utility files which have a similarity of about 35%, we see that some of the virus creation kits are not very effective. To detect metamorphic virus variants, we experimented with the use of hidden Markov models (HMMs) to capture the statistical properties of viruses in the same family. We generated 200 NGVCK viruses, trained 25 models and used the trained models to classify 65 programs including both NGVCK viruses and other random non-viral programs. For seven of our models we were able to perfectly distinguish the two types of files by their scores. The other cases produced different number of false positives and false negatives, depending on the threshold used in the classifying process. In most cases, our models were able to have a detection rate of over 90% and a false positive rate of less than 10%. The number of states N of a model does not seem to have much impact on the performance of the HMM. We saw only small differences in the performance measures for models with N from 3 to 6. If the variants of a metamorphic virus are sufficiently different that signature-based scanning cannot detect a newly morphed variant, the HMM approach provides a feasible solution. As with any statistical detection method, false predictions are possible. We showed the tradeoff between the detection rate and false positive rate.

Work on the use of hidden Markov models (HMM) to detect viruses has been carried out previously with good results [2], but metamorphic viruses like MetaPHOR [27] and metamorphic worms like MWOR [3] have proven to be able to evade detection techniques based on HMMs. The dueling HMM approach looks to detect such viruses by training an HMM model for each of the metamorphic virus / worm families. The tests and the results from these have shown that this approach has been able to detect the metamorphic MetaPHOR virus with reasonable accuracy but with significantly more overhead. This paper presents a tiered approach that improves on this by achieving the same results as the dueling approach but with significant performance improvement in terms of time. Essentially the idea is to eliminate most putative malware with the threshold approach, reserving the dueling HMM analysis for more difficult cases. We achieve accurate results with significantly less performance overhead than the dueling HMM strategy. Furthermore, our approach successfully detects MWOR worms with a high degree of accuracy.

Research on virus detection technique based on ensemble neural network and SVM

While pairwise sequence alignment (PSA) by dynamic programming is guaranteed to generate one of the optimal alignments, multiple sequence alignment (MSA) of highly divergent sequences often results in poorly aligned sequences, plaguing all subsequent phylogenetic analysis. One way to avoid this problem is to use only PSA to reconstruct phylogenetic trees, which can only be done with distance-based methods. I compared the accuracy of this new computational approach (named PhyPA for phylogenetics by pairwise alignment) against the maximum likelihood method using MSA (the ML+MSA approach), based on nucleotide, amino acid and codon sequences simulated with different topologies and tree lengths. I present a surprising discovery that the fast PhyPA method consistently outperforms the slow ML+MSA approach for highly diverged sequences even when all optimization options were turned on for the ML+MSA approach. Only when sequences are not highly diverged (i.e., when a reliable MSA can be obtained) does the ML+MSA approach outperforms PhyPA. The true topologies are always recovered by ML with the true alignment from the simulation. However, with MSA derived from alignment programs such as MAFFT or MUSCLE, the recovered topology consistently has higher likelihood than that for the true topology. Thus, the failure to recover the true topology by the ML+MSA is not because of insufficient search of tree space, but by the distortion of phylogenetic signal by MSA methods. I have implemented in DAMBE PhyPA and two approaches making use of multi-gene data sets to derive phylogenetic support for subtrees equivalent to resampling techniques such as bootstrapping and jackknifing.

Speech intelligibility can be improved by adding lip image and facial image to speech signal. Thus the lip image synthesis plays an important role to realize a natural human-like face of computer agents. Moreover the synthesized lip movement images can compensate lack of auditory information for hearing impaired people. We propose a novel lip movement synthesis method based on mapping from input speech based on Hidden Markov Model (HMM). This paper compares the HMM-based method and a conventional method using vector quantization (VQ). In the experiment, error and time differential error between synthesized lip movement images and original ones are used for evaluation. The result shows that the error of the HMM based method is 8.7% smaller than that of the VQ-based method. Moreover, the HMM-based method reduces time differential error by 32% than the VQ's. The result also shows that the errors are mostly caused by phoneme /h/ and /Q/. Since lip shapes of those phonemes are strongly dependent on succeeding phoneme, the context dependent synthesis on the HMM-based method is applied to reduce the error. The improved HMM-based method realizes reduction of the error (differential error) by 10.5% (11%) compared with the original HMM-based method.

SummaryMany animals communicate using sequences of discrete acoustic elements which can be complex, vary in their degree of stereotypy, and are potentially open‐ended. Variation in sequences can provide important ecological, behavioural or evolutionary information about the structure and connectivity of populations, mechanisms for vocal cultural evolution and the underlying drivers responsible for these processes. Various mathematical techniques have been used to form a realistic approximation of sequence similarity for such tasks.Here, we use both simulated and empirical data sets from animal vocal sequences (rock hyrax,Procavia capensis; humpback whale,Megaptera novaeangliae; bottlenose dolphin,Tursiops truncatus; andCarolina chickadee,Poecile carolinensis) to test which of eight sequence analysis metrics are more likely to reconstruct the information encoded in the sequences, and to test the fidelity of estimation of model parameters, when the sequences are assumed to conform to particular statistical models.Results from the simulated data indicated that multiple metrics were equally successful in reconstructing the information encoded in the sequences of simulated individuals (Markov chains,n‐gram models, repeat distribution and edit distance) and data generated by different stochastic processes (entropy rate andn‐grams). However, the string edit (Levenshtein) distance performed consistently and significantly better than all other tested metrics (including entropy,Markov chains,n‐grams, mutual information) for all empirical data sets, despite being less commonly used in the field of animal acoustic communication.TheLevenshtein distance metric provides a robust analytical approach that should be considered in the comparison of animal acoustic sequences in preference to other commonly employed techniques (such asMarkov chains, hiddenMarkov models orShannon entropy). The recent discovery that non‐Markovian vocal sequences may be more common in animal communication than previously thought provides a rich area for future research that requires non‐Markovian‐based analysis techniques to investigate animal grammars and potentially the origin of human language.

Today's massive amount of biological sequence data has the potential to rapidly advance our understanding of life's processes. However, since analyzing biological sequences is a very expensive computing task, users face a formidable challenge in trying to analyze these data on their own. Cloud computing offers access to a large amount of computing resources in an on-demand and pay-per-use fashion, which is a practical way for people to analyze these huge data sets. However, many people are still reluctant to outsource biological sequences to the cloud because they contain sensitive information that should be kept secret for ethical, security, and legal reasons. One of the most fundamental and frequently used computational tools for biological sequence analysis is pairwise sequence alignment (PSA). Previous works for securely solving PSAs at the cloud suffer from poor scalability, i.e., they are unable to exploit the cloud's infrastructure to solve PSAs in parallel because resource-limited users need to be constantly involved in the computations. In this paper, we develop a secure outsourcing algorithm that allows users to solve an arbitrary number of PSAs in parallel at the cloud. Compared with previous works, our algorithm can reduce computing time of a large number of PSAs by more than 50% with as few as 5 computing nodes at the cloud.

Metamorphic malware changes its internal structure with each generation, while maintaining its original behavior. Current commercial antivirus software generally scan for known malware signatures; therefore, they are not able to detect metamorphic malware that sufficiently morphs its internal structure. Machine learning methods such as hidden Markov models (HMM) have shown promise for detecting hacker-produced metamorphic malware. However, previous research has shown that it is possible to evade HMM-based detection by carefully morphing with content from benign files. In this paper, we combine HMM detection with a statistical technique based on the chi-squared test to build an improved detection method. We discuss our technique in detail and provide experimental evidence to support our claim of improved detection.

Metamorphic virus employs code obfuscation techniques to mutate itself. It absconds from signaturebased detection system by modifying internal structure without compromising original functionality. In this paper, we propose a new method, for detecting metamorphic computer viruses, that is based on the technique of Case-Based Reasoning (CBR). In this method: -Can detect similar viruses with high probability. - The updating of the virus database is done automatically without connecting to the Internet. Whenever a new virus is detected, it will be automatically added to the database used by our application. This presents a major advantage.

The Smith-Waterman (SW) algorithm is a typical technique for local sequence alignment in computational biology. However, the SW algorithm does not consider the local behaviours of the amino acids, which may result in loss of some useful information. Inspired by the success of Markov Edit Distance (MED) method, this paper therefore proposes a novel Markov pairwise protein sequence alignment (MPPSA) method that takes the local context dependencies into consideration. The numerical results have shown its superiority to the SW for pairwise protein sequence comparison.

Viruses and malware are serious threats to system security. There are different types of viruses today that it has become difficult to provide a precise definition [7]. Polymorphic and metamorphic viruses are two well known kinds of viruses. A polymorphic virus has the ability to change its signature every time by slightly modifying itself when it replicates, thus avoiding detection.The first polymorphic virus was developed in the year 1990 [16], and later many generator kits were developed that simplified the work of writing a computer virus. These kits enabled people with minimal knowledge to develop their own new viruses. There are also many packers and wrappers available that can be used to make viruses more difficult to detect.In this project, we analyze different polymorphic viruses and try to develop an application that will encrypt, mutate, and protect any polymorphic virus, thereby making it more difficult to detect.

User-generated content in social media contain very meaningful information about public sentiment and stance and require automated methods to analyze them extract knowledge from them. The recognition of sentiments, emotions and attitudes in textual data is necessary for understanding public stance and is highly desired for various services and procedures. In this work, we examine the performance of Hidden Markov Models (HMM) in the recognition of sentiments and opinions in text. Hidden Markov Models constitute a quite suitable approach given the special characteristics of the textual data. In particular, they can utilize the sequential nature of textual data, a piece of information that traditional machine learning approaches fail to fully take into account. We performed several experiments in order to assess the performance of different HMM-based methods under various training parameters and architectures. The evaluation results indicate that Hidden Markov Models achieve superior performance compared to traditional machine learning algorithms and highlight that they are scalable and accurate in analyzing user generated content and in specifying opinions and attitudes.

Pairwise sequence alignment is a fundamental compute-intensive problem in bioinformatics that has helped researchers analyse biological sequences. The analysis has helped biologists detect pathogens, develop drugs, and identify common genes. The biological sequence database has been growing rapidly due to new sequences being discovered. This has brought many new challenges including sequence database searching and aligning long sequences. To solve these problems, many sequence alignment algorithms have been developed. These algorithms employ various techniques to efficiently find optimal or nearly-optimal alignments. In this paper, we present the popular past and recent work on both local and global pairwise sequence alignment algorithms. In addition to identifying the techniques used, the advantages and limitations of the algorithms are also presented.

With an increase in the number of known biological functions of non-coding RNAs, the importance of RNA sequence alignment has risen. RNA sequence alignment problem has been investigated by many researchers as a mono-objective optimization problem where contributions from sequence similarity and secondary structure are taken into account through a single objective function. Since there is a trade-off between these two objective functions, usually we cannot obtain a single solution that has both the best sequence similarity score and the best structure score simultaneously. Multi-objective optimization is a widely used framework for the optimization problems with conflicting objective functions. So far, no one has examined how good alignments we can obtain by applying multi-objective optimization to structural RNA sequence alignment problem. We developed a pairwise RNA sequence alignment program, Cofolga2mo, based on multi-objective genetic algorithm (MOGA). We tested Cofolga2mo with a benchmark dataset which includes sequence pairs with a wide range of sequence identity, and we obtained at most 100 alignments for each inputted RNA sequence pair as an approximate set of weak Pareto optimal solutions. We found that the alignments in the approximate set give benchmark results comparable to those obtained by the state-of-the-art mono-objective RNA alignment algorithms. Moreover, we found that our algorithm is efficient in both time and memory usage compared to the other methods. Our MOGA programs for structural RNA sequence alignment can be downloaded at http://rna.eit.hirosaki-u.ac.jp/cofolga2mo/.