An Overview of Detection Techniques for Metamorphic Malware

Abstract

Malicious code designed to destroy or steal information from victim’s computer intentionally is known as malware. Signature-based detection is used to detect malware in antiviruses, but malware writers are using encryption and obfuscation to deter these detections. Techniques used to evade detection are broadly classified as polymorphism and metamorphism. Polymorphic malwares encrypt virus payload and decryption engine with different encryption keys, but virus payload remains the same. Metamorphic malware uses code obfuscation techniques, which regenerate distinct variant of same malware family. Detection of metamorphic malware is a challenging task, in the presence of code obfuscation. This paper gives an overview on different metamorphic malware detection techniques and analyzes their strengths and weaknesses.