Detecting Malware Variants by Byte Frequency
In order to make lots of new malwares fast and cheaply, attacker can simply modify the existing malwares based on their binary files to produce new ones, malware variants. Malware variants refer to all the new malwares manually or automatically produced from any existing malware. However, such simple approach to produce malwares can change signatures of the original malware so that the new malware variants can confuse and bypass most of popular signature-based anti-malware tools. In this paper, the authors propose a novel Byte Frequency Based Detecting Model (BFBDM) to deal with the malware variants identification issue.