Metamorphic malware detection using minimal opcode statistical patterns

High-speed and accurate malware detection for metamorphic malware are two goals in antiviruses. To reach beyond this issue, this chapter presents a new malware detection method that can be summarized as follows: (1) Input file is disassembled and classified to obtain the minimal opcode pattern as feature vectors; (2) a forward feature selection method (i.e., maximum relevancy and minimum redundancy) is applied to remove the redundant as well as irrelevant features; and (3) the process ends by classification through using decision tree. The results indicate the proposed method can effectively detect metamorphic malware in terms of speed, efficiency, and accuracy.