Malware Analysis and Classification: A Survey

TLDR

Malicious software, including polymorphic and metamorphic variants, poses a major Internet threat by constantly changing code, overwhelming signature‑based defenses, and exhibiting shared behavioral patterns across families. This survey reviews methods for analyzing and classifying malware. It describes how static and dynamic behavioral patterns are leveraged with machine‑learning techniques to detect and assign unknown malware to known families.

Abstract

One of the major and serious threats on the Internet today is malicious software, often referred to as a malware. The malwares being designed by attackers are polymorphic and metamorphic which have the ability to change their code as they propagate. Moreover, the diversity and volume of their variants severely undermine the effectiveness of traditional defenses which typically use signature based techniques and are unable to detect the previously unknown malicious executables. The variants of malware families share typical behavioral patterns reflecting their origin and purpose. The behavioral patterns obtained either statically or dynamically can be exploited to detect and classify unknown malwares into their known families using machine learning techniques. This survey paper provides an overview of techniques for analyzing and classifying the malwares.