Publication
Metamorphic Malware Detection with Machine Learning
| Summary: | Malware has been growing rapidly in both volume and sophistication, with increasingly complex obfuscation techniques used to create variants that evade detection. Beyond zero-day threats, metamorphic malware poses a particularly significant challenge by mutating its entire code while preserving its behavior, achieving an exceptional level of evasiveness. Metamorphic malware leverages these techniques by mutating the entire code and maintaining only program behavior, thus achieving the highest level of evasiveness. Traditional signature-based detection methods employed by commercial antivirus tools are inadequate against such threats. This has led to a surge in research proposing machine learning techniques for improved detection. However, a robust methodology capable of accurately detecting and classifying all malware types in the wild, supported by rigorous testing on varied datasets, remains elusive. Furthermore, ensuring computational efficiency is critical to enable real-time malware detection in practical scenarios. Deep learning models based on the transformer architecture have gained significant traction due to their power and effectiveness in language modeling tasks. The aim of this work is to develop a methodology capable of effectively and efficiently detecting all malware, with a simple approach applicable to a wide range of scenarios. For this purpose, transformers are leveraged to learn patterns in benign software, creating a robust anomaly-based detector that relies on the static analysis of unprocessed binaries. The approach demonstrates promising results in detecting metamorphic malware, achieving reasonable precision and recall in experimental testing. While further optimization is required to enhance generalization, accuracy, and scalability, these findings mark a significant advance in malware detection methodologies. |
|---|---|
| Main Authors: | Andrade, Yuri Lopes Jorge Chiado de |
| Subject: | Malware metamórfico deteção de malware deteção de anomalias aprendizagem automática transformers Teses de mestrado - 2025 |
| Year: | 2025 |
| Country: | Portugal |
| Document type: | master thesis |
| Access type: | open access |
| Associated institution: | Universidade de Lisboa |
| Language: | English |
| Origin: | Repositório da Universidade de Lisboa |
| Summary: | Malware has been growing rapidly in both volume and sophistication, with increasingly complex obfuscation techniques used to create variants that evade detection. Beyond zero-day threats, metamorphic malware poses a particularly significant challenge by mutating its entire code while preserving its behavior, achieving an exceptional level of evasiveness. Metamorphic malware leverages these techniques by mutating the entire code and maintaining only program behavior, thus achieving the highest level of evasiveness. Traditional signature-based detection methods employed by commercial antivirus tools are inadequate against such threats. This has led to a surge in research proposing machine learning techniques for improved detection. However, a robust methodology capable of accurately detecting and classifying all malware types in the wild, supported by rigorous testing on varied datasets, remains elusive. Furthermore, ensuring computational efficiency is critical to enable real-time malware detection in practical scenarios. Deep learning models based on the transformer architecture have gained significant traction due to their power and effectiveness in language modeling tasks. The aim of this work is to develop a methodology capable of effectively and efficiently detecting all malware, with a simple approach applicable to a wide range of scenarios. For this purpose, transformers are leveraged to learn patterns in benign software, creating a robust anomaly-based detector that relies on the static analysis of unprocessed binaries. The approach demonstrates promising results in detecting metamorphic malware, achieving reasonable precision and recall in experimental testing. While further optimization is required to enhance generalization, accuracy, and scalability, these findings mark a significant advance in malware detection methodologies. |
|---|
Funded activities
No funded projects found.