The Design Space of Metamorphic Malware
Andrew Walenstein†, Rachit Mathur‡, Mohamed R. Chouchane†, and Arun Lakhotia†

University of Louisiana at Lafayette, Lafayette, LA, U.S.A. McAfee Avert Labs, Beaverton, OR, U.S.A. arun@louisiana.edu rachit_mathur@avertlabs.com mohamed@louisiana.edu walenste@ieee.org
‡

†

Abstract: A design space is presented for metamorphic malware. Metamorphic malware is the class of malicious self-replicating programs that are able to transform their own code when replicating. The raison d'etre for metamorphism is to evade recognition by malware scanners; the transformations are meant to defeat analysis and decrease the number of constant patterns that may be used for recognition. Unlike prior treatments, the design space is organized according to the malware author's goals, options, and implications of design choice. The advantage of this design space structure is that it highlights forces acting on the malware author, which should help predict future developments in metamorphic engines and thus enable a proactive defence response from the community. In addition, the analysis provides effective nomenclature for classifying and comparing malware and scanners. Keywords: Metamorphic Malware, Virus Scanner.

1. Introduction
Metamorphism is the ability of malware to transform its code. This ability was first introduced in viruses and was later used by worms, Trojans, and other malware. There now exist several metamorphic engines—programs that implement only the logic for transforming code—that can simply be linked to any program to make it metamorphic. Metamorphic malware can be classified into four broad groups defined by two parameters. First, metamorphic malware may be either closed-world or open-world. Closed-world metamorphic malware is malware that is self-contained; in contrast, open-world malware may extend its capability by