Classification of metamorphic virus using n-grams signatures

• Main Authors: A Hamid, Isredza Rahmi, Md Sani, Nur Sakinah, Abdullah, Zubaile, Mohd Foozy, Cik Feresa, Kipli, Kuryati
• Format: Conference or Workshop Item
• Language: English
• Published: 2020
• Subjects: QA75-76.95 Calculating machines
• Online Access: http://eprints.uthm.edu.my/3476/1/KP%202020%20%2874%29.pdf; http://eprints.uthm.edu.my/3476/; http://dx.doi.org/10.1007/978-3-030-36056-6_14

Metamorphic virus has a capability to change, translate, and rewrite its own code once infected the system to bypass detection. The computer system then can be seriously damage by this undetected metamorphic virus. Due to this, it is very vital to design a metamorphic virus classification model that can detect this virus. This paper focused on detection of metamorphic virus using Term Frequency Inverse Document Frequency (TF-IDF) technique. This research was conducted using Second Generation virus dataset. The first step is the classification model to cluster the metamorphic virus using TF-IDF technique. Then, the virus cluster is evaluated using Naïve Bayes algorithm in terms of accuracy using performance metric. The types of virus classes and features are extracted from bi-gram assembly language. The result shows that the proposed model was able to classify metamorphic virus using TF-IDF with optimal number of virus class with average accuracy of 94.2%.