A Self-Relocation based Method for Malware Detection

Malware (malicious software) is software designed to disrupt computer operation, gather sensitive information, or gain unauthorized access to a computer system. Most malwares propagate themselves throughout the Internet by self-relocation. Self-relocation is a built-in module in most malwares that gets the base address of the code to correctly infect the other programs. Since most legitimate computer programs do not need the self-relocate module, the detection of malware with self-relocation module can be viewed as a promising approach for malware detection. This paper presents a self-relocation based method for both known and previously unknown malwares. The experiments indicate that the proposed approach has better ability to detect known and unknown malwares than other methods.