Using different substitution matrices in a string-matching technique for identifying viral polymorphic malware variants

Abstract

Antivirus systems have difficulty in detecting polymorphic variants of known viruses without explicit signatures for such variants. Initial work on investigating efficient and effective string-based approaches for the automatic generation of signatures for the identification of some or all new polymorphic variants, was initially encouraging. That initial work was restricted by a number of experimental aspects. The aim of the research reported here is to examine the effects of using different substitution matrices in a string-based methods for the automatic generation of signatures for the detection of some or all new polymorphic variants. We establish how our proposed syntactic-based method using the well-known string matching Smith-Waterman algorithm can successfully identify the known polymorphic variants of JS. Cassandra virus. Our string-matching technique may metamorphose our understanding of polymorphic variant generation and may lead to a new phase of syntactic-based anti-viral software.