Hands-On Artificial Intelligence for Cybersecurity

Polymorphic malware detection strategies

In the constant cat and mouse game established between malware developers and antivirus software producers, the latter have tried to keep up the pace, adapting their detection strategies to the different forms of polymorphism.

In the case of polymorphic malware, one of the strategies adopted consists of code emulation: the execution of the malware inside a controlled environment (such as the sandbox), allowing the malware to carry out the decrypt phase of the payload, to which the traditional signature-based detection performed by the antivirus software follows.

In the case of metamorphic malware, as well as zero days, the detection activity carried out by the most sophisticated antivirus software ...