Normalization towards Instruction Substitution Metamorphism Based on Standard Instruction Set

Metamorphic malware is able to change its signature which is a fixed sequence of bytes or code from generation to generation. This makes the traditional scanner based on the signature difficult to detect it. Combing normalization with traditional scanner is a promising direction to solve the problem. The idea is: firstly transform the code into canonical form then pass it into scanner to check. This paper proposes a novel normalization method towards instruction substitution which is a commonly used metamorphism approach. The method mainly involves two steps. Firstly, the input code is rewritten with standard instructions. Secondly, the order of standard instructions is adjusted based on the data dependence graph of each basic block. A case study of normalizing Win32.Evol has been carried out. The results demonstrate the feasibility of our method to make variants, including the original code, tend to be uniform.