Metamorphic Viruses' Detection Technique Based on the Equivalent Functional Block Search

The article presents a new technique for metamorphic viruses detection based on the search of equivalent functional blocks. The method takes into account the obfuscation techniques of blocks reordering. The method involves the searching of the correspondences between the functional blocks of the metamorphic versions, and consists of two stages. On the first stage the equivalent functional blocks based on the statistical evaluation of the instructions appearance in the block are to be searched. The second stage involves the choice refinement of equivalent blocks and selection the most appropriate block, which will be used for the the forming of the feature vector of similarity for metamorphic viruses’ versions. The method carries out the classification of feature vectors with the involvement of fuzzy logic. The proposed method allows to reduce the number of false positives in comparison with the previous study.