Structural features with nonnegative matrix factorization for metamorphic malware detection

Metamorphic malware is well known for evading signature-based detection by exploiting various code obfuscation techniques. Current metamorphic approaches require some prior knowledge during feature engineering stage to extract patterns and behaviors from malware. In this paper, we attempt complement extend previous techniques proposing a approach based on structure analysis using information theoretic measures statistical metrics with machine learning model. particular, compression ratio, entropy, Jaccard coefficient Chi-square tests are used as representations reveal the byte existing in binary file. Furthermore, Nonnegative Matrix Factorization, dimension can be reduced. The experimental results show hexadecimal representation effective Windows an accuracy rate F-score high 0.9972 0.9958, respectively. Whereas Linux morphed detection, statistic test shows 0.9878 0.9901, Overall, proposed technique of reduction useful detecting