Evolvable malware

  • Authors:
  • Sadia Noreen;Shafaq Murtaza;M. Zubair Shafiq;Muddassar Farooq

  • Affiliations:
  • FAST National University of Computer & Emerging Sciences (FAST-NUCES), Islamabad, Pakistan;FAST National University of Computer & Emerging Sciences (FAST-NUCES), Islamabad, Pakistan;FAST National University of Computer & Emerging Sciences (FAST-NUCES), Islamabad, Pakistan;FAST National University of Computer & Emerging Sciences (FAST-NUCES), Islamabad, Pakistan

  • Venue:
  • Proceedings of the 11th Annual conference on Genetic and evolutionary computation
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

The concept of artificial evolution has been applied to numerous real world applications in different domains. In this paper, we use this concept in the domain of virology to evolve computer viruses. We call this domain as "Evolvable Malware". To this end, we propose an evolutionary framework that consists of three modules: (1) a code analyzer that generates a high-level genotype representation of a virus from its machine code, (2) a genetic algorithm that uses the standard selection, cross-over and mutation operators to evolve viruses, and (3) the code generator converts the genotype of a newly evolved virus to its machinelevel code. In this paper, we validate the notion of evolution in viruses on a well-known virus family, called Bagle. The results of our proof-of-concept study show that we have successfully evolved new viruses-previously unknown and known-variants of Bagle-starting from a random population of individuals. To the best of our knowledge, this is the first empirical work on evolution of computer viruses. In future, we want to improve this proof-of-concept framework into a full-blown virus evolution engine.