Abstract
Recent malware authors generate lots of malware variants using malware toolkits. Also, the malware has been generated using various techniques for avoiding detection by anti-virus software. In particular, metamorphic malware avoids such detection in anti-virus software by modifying codes automatically including a metamorphic engine as such malware is propagated. In this paper, an analysis of instruction substitution for metamorphic malware is performed and an instruction substitution rule is presented.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Zhang Q, Reeves DS (2007) MetaAware: identifying metamorphic malware. In: Proceedings of the 23rd annual computer security applications conference, pp 411–420
Szor P (2005) The art of computer virus research and defense. Addison Wesley Professional, Boston
Jin R, Wei Q, Yang P, Wang Q (2007) Normalization towards instruction substitution metamorphism based on standard instruction set. In: Proceedings of the IEEE symposium on 2007 international conference on computational intelligence and security workshops, pp 795–798
VX Heavens, Available at http://vx.netlux.org/
Han KS, Im EG (2011) An analysis on instruction substitution for metamorphic malware. In: Proceedings of the 2011 summer conference of Korea information and communications society
Acknowledgement
This work was supported by the Mid-career Researcher Program of the NRF grant funded by the MEST (NRF 2010-1179-000).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2012 Springer Science+Business Media B.V.
About this paper
Cite this paper
Han, KS., Chung, KY., Im, E.G. (2012). A Study on Instruction Substitution Analysis of Metamorphic Malware. In: Kim, K., Ahn, S. (eds) Proceedings of the International Conference on IT Convergence and Security 2011. Lecture Notes in Electrical Engineering, vol 120. Springer, Dordrecht. https://doi.org/10.1007/978-94-007-2911-7_57
Download citation
DOI: https://doi.org/10.1007/978-94-007-2911-7_57
Published:
Publisher Name: Springer, Dordrecht
Print ISBN: 978-94-007-2910-0
Online ISBN: 978-94-007-2911-7
eBook Packages: EngineeringEngineering (R0)