Team for Research in
Ubiquitous Secure Technology

Citation
Mark Stamp, Srilatha Attaluri, Scott McGhee. "Profile hidden Markov models and metamorphic virus detection". Journal in Computer Virology, 2008.

Abstract
Metamorphic computer viruses "mutate" by changing their internal structure and, consequently, different instances of the same virus may not exhibit a common signature. With the advent of construction kits, it is easy to generate metamorphic strains of a given virus. In contrast to standard hidden Markov models (HMMs), profile hidden Markov models (PHMMs) explicitly account for positional information. In principle, this positional information could yield stronger models for virus detection. However, there are many practical difficulties that arise when using PHMMs, as compared to standard HMMs. Profile hidden Markov models are widely used in bioinformatics. For example, PHMMs are the most effective tool yet developed for finding family-related DNA sequences. In this paper, we consider the utility of PHMMs for detecting metamorphic virus variants generated from virus construction kits. PHMMs are generated for each construction kit under consideration and the resulting models are used to score virus and non-virus files. Our results are encouraging, but several problems must be resolved for the technique to be truly practical.

Electronic downloads

• HTML

  Mark Stamp, Srilatha Attaluri, Scott McGhee. <a
  href="http://www.truststc.org/pubs/422.html"
  >Profile hidden Markov models and metamorphic virus
  detection</a>, <i>Journal in Computer
  Virology</i>,  2008.

• Plain text

  Mark Stamp, Srilatha Attaluri, Scott McGhee. "Profile
  hidden Markov models and metamorphic virus detection".
  <i>Journal in Computer Virology</i>,  2008.

• BibTeX

  @article{StampAttaluriMcGhee08_ProfileHiddenMarkovModelsMetamorphicVirusDetection,
      author = {Mark Stamp and Srilatha Attaluri and Scott McGhee},
      title = {Profile hidden Markov models and metamorphic virus
                detection},
      journal = {Journal in Computer Virology},
      year = {2008},
      abstract = {Metamorphic computer viruses "mutate" by changing
                their internal structure and, consequently,
                different instances of the same virus may not
                exhibit a common signature. With the advent of
                construction kits, it is easy to generate
                metamorphic strains of a given virus. In contrast
                to standard hidden Markov models (HMMs), profile
                hidden Markov models (PHMMs) explicitly account
                for positional information. In principle, this
                positional information could yield stronger models
                for virus detection. However, there are many
                practical difficulties that arise when using
                PHMMs, as compared to standard HMMs. Profile
                hidden Markov models are widely used in
                bioinformatics. For example, PHMMs are the most
                effective tool yet developed for finding
                family-related DNA sequences. In this paper, we
                consider the utility of PHMMs for detecting
                metamorphic virus variants generated from virus
                construction kits. PHMMs are generated for each
                construction kit under consideration and the
                resulting models are used to score virus and
                non-virus files. Our results are encouraging, but
                several problems must be resolved for the
                technique to be truly practical.},
      URL = {http://www.truststc.org/pubs/422.html}
  }
  

Posted by Mark Stamp on 18 Aug 2008.
For additional information, see the Publications FAQ or contact webmaster at www truststc org.