Metamorphic malware detection using structural features and nonnegative matrix factorization with hidden markov model

Metamorphic malware modifies its code structure using a morphing engine to evade traditional signature-based detection. Previous research has shown the use of opcode instructions as feature representation with Hidden Markov Model in context metamorphic However, it would be more feasible extract file at fine-grained level. In this paper, we propose novel detection approach by generating structural features through computing stream byte chunks compression ratio, entropy, Jaccard similarity coefficient and Chi-square statistic test. Nonnegative Matrix Factorization is also considered reduce dimensions. We then vectors from reduced space train Model. Experimental results show there different performance between classification among proposed features.