Nonnegative matrix factorization and metamorphic malware detection

• Main Authors: Ling, Yeong Tyng, Nor Fazlida, Mohd Sani, Mohd Taufik, Abdullah, Nor Asilah Wati, Abdul Hamid
• Format: Article
• Language: English
• Published: Springer Nature Switzerland AG 2019
• Subjects: QA75 Electronic computers. Computer science
• Online Access: http://ir.unimas.my/id/eprint/31790/3/Nonnegative.pdf; http://ir.unimas.my/id/eprint/31790/; https://link.springer.com/article/10.1007/s11416-019-00331-0

Metamorphic malware change their internal code structure by adopting code obfuscation technique while maintaining their malicious functionality during each infection. This causes change of their signature pattern across each infection and makes signature based detection particularly difficult. In this paper, through static analysis, we use similarity score from matrix factorization technique called Nonnegative Matrix Factorization for detecting challenging metamorphic malware. We apply this technique using structural compression ratio and entropy features and compare our results with previous eigenvector-based techniques. Experimental results from three malware datasets show this is a promising technique as the accuracy detection is more than 95%.