Detection of polymorphic viruses in windows executables

Abstract

Polymorphic viruses are viruses which unpack themselves at runtime and infect files with a new mutated virus body. Most of the current solutions present blacklist a set of packer. Research has shown many polymorphic viruses to go undetected. This work aims at the problem of detection of such viruses using emulation technique. The main target is to improve the detection rate and reduce false positives. Bochs is a powerful x86-64 emulator and the system has been implemented on Bochs and could successfully detect self-modifying code in test viruses. © 2010 Springer-Verlag Berlin Heidelberg.