Morphing engines classification by code histogram

Morphing engines or mutation engines are exploited by metamorphic virus to change the code appearance in every new generation. The purpose of these engines is to escape from the signature-based scanner, which employs a unique string signature to detect the virus. Although the obfuscation techniques try to convert the binary sequence of the code, in some techniques, the statistical feature of the code binaries will be still remain unchanged, relatively. Accordingly, this feature can be utilized to classify the engine and detect the morphed virus code. In this article, we are going to introduce a new idea to classify the obfuscation engines based on their code statistical feature using the histogram comparison. Keywords-component: Computer Virus, Malware Morphing Engines, Obfuscation Engines, Mutation Engine, Metamorphic Virus, Code Histogram, Histogram Comparison I. INTRODUCTION The purpose of code obfuscation techniques is to make program codes more complicated to be comprehensible by a static analysis (1-2). To achieve this purpose, the obfuscation engine transforms the program code to another dissimilar edition, but keeps the behavior of the different versions equivalent (3). This skill can be used to protect the software from tampering or being visible for hackers, however it is widely being utilized by virus writers to make their virus armored against the antivirus experts (4). Metamorphic viruses try to convert their code into new versions with dissimilar byte sequences, by means of obfuscation techniques. Therefore, traditional string signature- based scanners are not efficiently able to detect and classify the new instances. In this study, we aim to propose a relatively novel idea to deal with metamorphic engine, which emphasizes on a statistical feature of the code, the histogram of the code bytes. Here, we are going to show that this new approach is applicable for classification of the obfuscation engines. This solution can be developed and improved in the future to be more reliable and effectual and be used in the antivirus scanners. In next section, we review the recent attempts on this problem and most related methodologies and experiments. Then we present our proposed solution and explain its novelty. In the next part, we illustrate the methodology and implementation process, and in the final section, we give the summary and some recommendations for the future developments.