Detecting Malware with Information Complexity.

Area of Science:

• Computer Science
• Cybersecurity
• Information Theory

Background:

• Malware authors frequently use polymorphism and metamorphism to create variants, complicating detection.
• Despite obfuscation, malware variants retain discernible patterns, offering potential for identification.

Purpose of the Study:

• To evaluate the effectiveness of Normalized Compression Distance (NCD) in identifying malware variants.
• To develop a novel, pattern-based approach for malware classification.

Main Methods:

• Utilized Normalized Compression Distance (NCD) to measure information similarity between suspect programs and known malware/benign-ware.
• Employed decision forests to combine NCD with executable compressibility rates for improved accuracy.
• Assessed performance against a large dataset of disk-resident malware and compared results with 59 anti-malware programs.

Main Results:

• Achieved 97.4% accuracy and a 3% false positive rate in classifying disk-resident malware.
• Demonstrated sustained high accuracy (95.2%) even with malware reported over two years.
• The NCD-based method outperformed individual anti-malware programs and matched collective performance.

Conclusions:

• Normalized Compression Distance (NCD) presents a powerful, pattern-based strategy for combating malware variants.
• Combining NCD with compressibility analysis offers a promising avenue for enhancing malware detection accuracy.
• This approach provides a cost-effective countermeasure for malware authors by requiring obfuscation of string patterns.