Research on Normalization towards Instructions Reordering Metamorphism Technique
针对指令乱序变形技术的归一化研究

Much of apparently new malware comes from transformed known malware.Metamorphic malware could even complete this process automatically.The mutable signature makes the traditional detection method based on it difficult to detect metamorphic malware.Combining normalization idea with the traditional detection technology is a promising approach to resolve the problem.This paper proposes a normalization scheme towards instructions reordering metamorphism technique.In the scheme,the inspected code is firstly partitioned into some basic control blocks based on control-dependency analysis,then the instructions order in each block is adjusted according to the data-dependency graph.After the variants of malware are normalized according to the scheme,they tend to have the same form.The scheme is applicable to both jump method and non-jump method which are two implementations of instructions reordering.Testing has been conducted to validate the feasibility of the scheme.