Publication Date
Spring 2012
Degree Type
Master's Project
Degree Name
Master of Science (MS)
Department
Computer Science
Abstract
Metamorphic malware changes its internal structure across generations, but its functionality remains unchanged. Well-designed metamorphic malware will evade signature detection. Recent research has revealed techniques based on hidden Markov models (HMMs) for detecting many types of metamorphic malware, as well as techniques for evading such detection. A worm is a type of malware that actively spreads across a network to other host systems. In this project we design and implement a prototype metamorphic worm that carries its own morphing engine. This is challenging, since the morphing engine itself must be morphed across replications, which imposes significant restrictions on the structure of the worm. Our design also employs previously developed techniques to evade detection. We provide test results to confirm that this worm effectively evades signature and HMM-based detection, and we consider possible detection strategies. This worm provides a concrete example that should prove useful for additional malware detection research.
Recommended Citation
Sridhara, Sudarshan Madenur, "METAMORPHIC WORM THAT CARRIES ITS OWN MORPHING ENGINE" (2012). Master's Projects. 240.
DOI: https://doi.org/10.31979/etd.unb6-nb8s
https://scholarworks.sjsu.edu/etd_projects/240
