Antiviral software systems (AVSs) have problems in identifying polymorphic variants of viruses without explicit signatures for such variants. Alignment-based techniques from bioinformatics may provide a novel way to generate signatures from consensuses found in polymorphic variant code. We demonstrate how multiple sequence alignment supplemented with gap penalties leads to viral code signatures that generalize successfully to previously known polymorphic variants of JS. Cassandra virus and previously unknown polymorphic variants of W32.CTX/W32.Cholera and W32.Kitti viruses. The implications are that future smart AVSs may be able to generate effective signatures automatically from actual viral code by varying gap penalties to cover for both known and unknown polymorphic variants.
Symantec Internet Security Threat Report (2014) Symantec Corporation. http://www.symantec.com
Global Risks 2012: Insight Report (2012) World Economic Forum. http://reports.weforum.org/global-risks-2012/
Kephart, J. and Arnold, W. (1994) Automatic Extraction of Computer Virus Signatures. Proceedings of the 4th Virus Bulletin International Conference, Abingdon, England, 178-184. https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=Automatic+extraction+of +computer+virus+signatures&btnG=
Christodorescu, M., Jha, S., Seshia, S.A., Song, D. and Bryant, R.E. (2005) Semantics-Aware Malware Detection. Proceedings of the IEEE Symposium on Security and Privacy SP ‘05, California, 8-11 May 2005, 32-46. https://doi.org/10.1109/sp.2005.20
Sathyanarayanan, V.S., Kohli, P. and Bruhadesgwar, B. (2008) Signature Generation and Detection of Malware Families. In: Mu, Y., Susilo, W. and Seberry, J., Eds., Information Security and Privacy, Lecture Notes in Computer Science, Springer-Verlag, Heidelberg, 336-349. https://doi.org/10.1007/978-3-540-70500-0_25
Ellis, D., Aiken, J.G., Attwood, K.S. and Tenaglia, S.D. (2004) A Behavioral Approach to Worm Detection, Proceedings of the ACM Workshop on Rapid Malcode (WORM04), Washington, DC, 29 October 2004, 43-53. https://doi.org/10.1145/1029618.1029625
Gao, D., Reiter, M.K. and Song, D. (2006) Behavioral Distance for Intrusion Detection. In: Valdes, A. and Zamboni, D., Eds., Recent Advances in Intrusion DetectionRAID 2005, Lecture Notes in Computer Science, Springer-Verlag, Heidelberg, 63-81. https://doi.org/10.1007/11663812_4
Cesare, S. and Xiang, Y. (2010) Classification of Malware Using Structured Control Flow. Proceedings of the 8th Australasian Symposium on Parallel and Distributed Computing (AusPDC), Brisbane, 1 January 2010, 61-70.
Tang, H., Zhu, B. andRen, K. (2009) A New Approach to Malware Detection. In: Park, J.H., Chen, HH., Atiquzzaman, M., Lee, C., Kim, T. and Yeo, SS., Eds., Advances in Information Security and Assurance ISA 2009, Lecture Notes in Computer Science, Springer-Verlag, Heidelberg, 229-238. https://doi.org/10.1007/978-3-642-02617-1_24
Kinder, J., Katzenbeisser, S., Schallhart, C. and Veith, H. (2005) Detecting Malicious Code by Model Checking. In: Julisch, K. and Kruegel, C., Eds., Detection of Intrusions and Malware, and Vulnerability Assessment DIMVA 2005, Lecture Notes in Computer Science, Springer-Verlag, Heidelberg, 174-187. https://doi.org/10.1007/11506881_11
Bailey, M., Oberheide, J., Andersen, J., Mao, Z.M., Jahanian, F. and Nazario, J. (2007) Automated Classification and Analysis of Internet Malware. In: Kruegel, C., Lippmann, R. and Clark, A., Eds., Recent Advances in Intrusion Detection RAID 2007. Lecture Notes in Computer Science, Springer-Verlag, Heidelberg, 178-197. https://doi.org/10.1007/978-3-540-74320-0_10
Eskandari, M. and Hashemi, S. (2012) A Graph Mining Approach for Detecting Unknown Malware. Journal of Visual Languages and Computing, 23, 154-162.
Chaumette, S., Ly, O. and Tabary, R. (2011) Automated Extraction of Polymorphic Signatures Using Abstract Interpretation. Proceedings of the 5th International Conference on Network and Systems Security (NSS), Milan, 6-8 September 2011, 41-48. https://doi.org/10.1109/icnss.2011.6059958
Zhang, Q. and Reeves, D.S. (2007) MetaAware: Identifying Metamorphic Malware. Proceedings of the IEEE 23rd Annual Computer Security Applications Conference, Florida, 10-14 December 2007, 411-420. https://doi.org/10.1109/acsac.2007.9
Steinbock, B. and Martini, P. (2009) Classification and Detection of Metamorphic Malware Using Value Set Analysis. Proceedings of the 4th International Conference on Malicious and Unwanted Software, Quebec, 13-14 October 2009, 39-46.
Griffin, K., Schneider, S., Hu, X. and Chiueh, T. (2009) Automatic Generation of String Signatures for Malware Detection. In: Kirda, E., Jha, S. and Balzarotti, D., Eds., Recent Advances in Intrusion Detection RAID 2009. Lecture Notes in Computer Science, Springer-Verlag, Heidelberg, 101-120. https://doi.org/10.1007/978-3-642-04342-0_6
Moser, A., Kruegel, C. and Kirda, E. (2007) Limits of Static Analysis for Malware Detection. Proceedings of the IEEE 23rd Annual Computer Security Applications Conference, Florida, 10-14 December 2007, 421-430. https://doi.org/10.1109/acsac.2007.21
Rastogi, V., Chen, Y. and Jiang, X. (2014) Catch Me If You Can: Evaluating Android Anti-Malware against Transformation Attacks. IEEE Transactions on Information Forensics and Security, 9, 99-108. https://doi.org/10.1109/TIFS.2013.2290431
Schultz, M.G., Eskin, E., Zadok, E. and Stolfo, S.J. (2001) Data Mining Methods for Detection of New Malicious Executables. Proceedings of the IEEE Symposium on Security & Privacy, California, 14-16 May 2001, 38-49. https://doi.org/10.1109/secpri.2001.924286
Baldangombo, U., Jambaljav, N. and Horng, S-J. (2013) A Static Malware Detection System Using Data Mining Methods. https://arxiv.org/abs/1308.2831 https://doi.org/10.5121/ijaia.2013.4411
Komashinskiy, D. and Kotenko, I. (2010) Malware Detection by Data Mining Techniques Based on Positionally Dependent Features. Proceedings of the 18th Euromicro Conferences on Parallel, Distributed and Network-based Processing, Pisa, 17-19 February 2010, 617-623. https://doi.org/10.1109/pdp.2010.30
Tabish, S.M., Shafiq, M.Z. and Farooq, M. (2009) Malware Detection Using Statistical Analysis of Byte-Level File Content. Proceedings of the 15th ACM SIGKDD Workshop on Cybersecurity and Intelligence Informatics, Paris, 28 June - 1 July 2009, 23-31. https://doi.org/10.1145/1599272.1599278
Abou-Assaleh, T., Cercone, N. and Sweidan, R. (2004) Detection of New Malicious Code Using N-Grams Signatures. Proceedings of the 2nd Annual Conference on Privacy, Security and Trust, New Brunswick, 13-15 October 2004, 13-15.
Kolter, J.Z. and Maloof, M.A. (2006) Learning to Detect and Classify Malicious Executables in the Wild. Journal of Machine Learning Research, 7, 2721-2744.
Shafiq, M.Z., Tabish, S.M. and Farooq, M. (2008) Embedded Malware Detection Using Markov N-Grams. Proceedings of the 5th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Paris, 10-11 July 2008, 88-107. https://doi.org/10.1007/978-3-540-70542-0_5
Skoudis, E. and Zeltser, L. (2004) Malware: Fighting Malicious Code. United States: Prentice Hall Professional, New Jersey.
Ferrie, P. and Ször, P. (2001) Hunting for Metamorphic. Virus, 123-143. https://pdfs.semanticscholar.org/4e07/1925c789610a6c4db9d460b5d45b4f1ec861.pdf
Chen, Y., Narayanan, A., Pang, S. and Tao, B. (2012) Malicioius Software Detection Using Multiple Sequence Alignment and Data Mining. Proceedings of the 2012 IEEE 26th International Conference on Advanced Information Networking and Applications (AINA), 26-29 March 2012, 8-14. https://doi.org/10.1109/AINA.2012.62
Naidu, V. and Narayanan, A. (2016) A Syntactic Approach for Detecting Viral Polymorphic Malware Variants. In: Chau, M., Wang, G. and Chen, H., Eds., Intelligence and Security Informatics PAISI 2016. Lecture Notes in Computer Science, Springer-Verlag, Heidelberg, 146-165. https://doi.org/10.1007/978-3-319-31863-9_11
Naidu, V. and Narayanan, A. (2016) Using Different Substitution Matrices in a String-Matching Technique for Identifying Viral Polymorphic Malware Variants. Proceedings of the 2016 IEEE Congress on Evolutionary Computation (WCCI-IEEE CEC), Vancouver, 24-29 July 2016, 2903-2910. https://doi.org/10.1109/cec.2016.7744156
Naidu, V. and Narayanan, A. (2016) Needleman-Wunsch and Smith-Waterman Algorithms for Identifying Viral Polymorphic Malware Variants. Proceedings of the 14th IEEE International Conference on Dependable, Autonomic and Secure Computing (DASC), Auckland, 8-12 August 2016, 326-333. https://doi.org/10.1109/dasc-picom-datacom-cyberscitec.2016.73
Naidu, V. and Narayanan, A. (2014) Further Experiments in Biocomputational Structural Analysis of Malware. Proceedings of the 10th IEEE International Conference on Natural Computation (ICNC), 19-21 August 2014, 605-610. https://doi.org/10.1109/icnc.2014.6975904
Kim, H.-A. and Karp, B. (2004) Autograph: Toward Automated, Distributed Worm Signature Detection. SSYM’04 Proceedings of the 13th conference on USENIX Security Symposium, San Diego, CA, 9-13 August, 13, 19-19.
Kreibich, C. and Crowcroft, J. (2004) Honeycomb: Creating Intrusion Detection Signatures Using Honeypots. ACM SIGCOMM Computer Communication Review, 34, 51-56. https://doi.org/10.1145/972374.972384
Singh, S., Estan, C., Varghese, G. and Savage, S. (2004) Automated Worm Fingerprinting. OSDI’04 Proceedings of the 6th conference on Symposium on Operating Systems Design & Implementation, San Francisco, CA, 06-08 December, 6, 4.
Newsome, J., Karp, B. and Song, D. (2005) Polygraph: Automatically Generating Signatures for Polymorphic Worms. IEEE Symposium on Security and Privacy, Oakland, CA, USA, 8-11 May, 226-241. https://doi.org/10.1109/SP.2005.15
Wang, K., Cretu, G. andStolfo, S.J. (2005) Anomalous Payload-Based Worm Detection and Signature Generation. RAID’05 Proceedings of the 8th international conference on Recent Advances in Intrusion Detection, Seattle, WA, 7-9 September, 227-246. https://doi.org/10.1007/11663812_12
Yegneswaran, V., Giffon, J. T., Barford, P. andJha, S. (2005) An Architecture for Generating Semantic Aware Signatures. SSYM’05 Proceedings of the 14th Conference on USENIX Security Symposium, Baltimore, MD, 31 July-05 August, 14, 34-43.
Li, Z., Sanghi, M., Chen, Y., Kao, M.-Y. and Chavez, B. (2006) Hamsa: Fast Signature Generation for Zero-Day Polymorphic Worms with Provable Attack Resilience. IEEE Symposium on Security and Privacy, 21-24 May, 32-47. https://doi.org/10.1109/SP.2006.18
Rieck, K., Schwenk, G., Limmer, T., Holz, T. and Laskov, P. (2010) Botzilla: Detecting the Phoning Home of Malicious Software. SAC’10 Proceedings of the 2010 ACM Symposium on Applied Computing,Sierre, Switzerland, 22-26 March, 1978-1984.
Cui, W., Peinado, M., Wang, H. J. andLocasto, M. E. (2007) Shieldgen: Automaticdata Patch Generation for Unknown Vulnerabilities with Informed Probing. IEEE Symposium on Security and Privacy, Berkeley, CA, USA, 20-23 May, 252-266. https://doi.org/10.1109/SP.2007.34
Xie, Y., Yu, F., Achan, K., Panigrahy, R., Hulten, G. andOsipkov, I. (2008) Spamming Botnets: Signatures and Characteristics. ACM SIGCOMM Computer Communication Review, 38, 171-182. http://doi.acm.org/10.1145/1402946.1402979
Wurzinger, P., Bilge, L., Holz, T., Goebel, J., Kruegel, C. andKirda, E. (2009) Automatically Generating Models for Botnet Detection. ESORICS’09 Proceedings of the 14th European Conference on Research in Computer Security, Saint-Malo, France, 21-23 September, 232-249.
Rossow, C. and Dietrich, C. J. (2013) Provex: Detecting Botnets with Encrypted Command and Control Channels. DIMVA’13 Proceedings of the 10th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Berlin, Germany, 18-19 July, 21-40. https://doi.org/10.1007/978-3-642-39235-1_2
Caballero, J., Johnson, N.M., McCamant, S. and Song, D. (2009) Binary Code Extraction and Interface Identification for Security Applications. Technical Report, DTIC Document, No. UCB/EECS-2009-133.
Rafique, M. Z. and Caballero, J. (2013) Firma: Malware Clustering and Network Signature Generation with Mixed Network Behaviors. RAID 2013 Proceedings of the 16th International Symposium on Research in Attacks, Intrusions, and Defenses, Rodney Bay, St. Lucia, 23-25 October, 8145, 144-163. https://doi.org/10.1007/978-3-642-41284-4_8
Scheirer, W. and Chuah, M.C. (2008) Syntax vs. Semantics: Competing Approaches to Dynamic Network Intrusion Detection. International Journal of Security and Networks, 3, 24-35. https://doi.org/10.1504/IJSN.2008.016199
Coull, S.E. and Szymanski, B.K. (2008) Sequence Alignment for Masquerade Detection. Computational Statistics & Data Analysis, 52, 4116-4131.
Wespi, A., Dacier, M. and Debar, H. (1999) An Intrusion-Detection System Based on the Teiresias Pattern-Discovery Algorithm. IBM Thomas J.Watson Research Division.
Zhao, Y., Tang, Y., Wang, Y. and Chen, S. (2013) Generating Malware Signature Using Transcoding from Sequential Data to Amino Acid Sequence. International Conference on High Performance Computing and Simulation (HPCS), Helsinki, Finland, 1-5 July, 266-272. https://doi.org/10.1109/HPCSim.2013.6641425
Ki, Y., Kim, E. and Kim, H.K. (2015) A Novel Approach to Detect Malware Based on API Call Sequence Analysis. International Journal of Distributed Sensor Networks, 2015, Article No. 4. https://doi.org/10.1155/2015/659101
Kirat, D. and Vigna, G. (2015) Malgene: Automatic Extraction of Malware Analysis Evasion Signature. CCS’15 Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, Colorado, USA, 12-16 October, 769-780. https://doi.org/10.1145/2810103.2813642
Kumar, V. and Mishra, S.K. (2013) Detection of Malware by Using Sequence Alignment Strategy and Data Mining Techniques. International Journal of Computer Applications, 62. https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=Detection+of+Malware+by+Using+Sequence+Alignment+Strategy+and+ Data+Mining+Techniques&btnG=
Oracle VM VirtualBox (2016) VirtualBox. https://www.virtualbox.org/
JS.Cassandra by Second Part To Hell (2014) rRlF#4 (Redemption). http://spth.virii.lu/rrlf4/rRlf.13.html
Viruses: w32.kitti.rar (2013) Second Part To Hell’s Artworks. http://spth.virii.lu/w32.kitti.rar
VirusTotal (2016) Free Online Virus, Malware and URL Scanner. https://www.virustotal.com/
ClamavNet (2015) ClamAV ® is an Open Source Antivirus Engine for Detecting Trojans, Viruses, Malware & Other Malicious Threats. https://www.clamav.net/
Moustafa, A. (2010) JAligner: Java Implementation of the Smith-Waterman Algorithm for Biological Sequence Alignment. Retrieved from SourceForge: http://jaligner.sourceforge.net/
Clustal (2012) Clustal: Multiple Sequence Alignment. Retrieved from Clustal: http://www.clustal.org/download/clustalw_help.txt
Yan, R., Wang, X., Huang, L., Lin, J., Cai, W. and Zhang, Z. (2014) GPCRserver: An Accurate and Novel G Protein-Coupled Receptor Predictor. Molecular BioSystems, 10, 2495-2504. https://doi.org/10.1039/C4MB00272E
Notredame, C., Higgins, D. G., & Heringa, J. (2000) T-Coffee: A Novel Method for Fast and Accurate Multiple Sequence Alignment. Journal of Molecular Biology, 302, 205-217. Retrieved from EMBL-EBI: http://www.ebi.ac.uk/Tools/msa/tcoffee/ https://doi.org/10.1006/jmbi.2000.4042
TopTenReviews (2016) Top 10 Best Antivirus Software for 2016—Top Ten Reviews. http://www.toptenreviews.com/