An Investigative Study on Malware Signatures

Abstract

Malware signatures are vital in identifying, detecting, and mitigating malicious software threats. This study delves into the different types of malware signatures, including static, behavioral, and heuristic signatures, and examines their creation processes and detection methods. Static signatures, such as byte sequence and hash based signatures, offer high accuracy for known threats but struggle with new, unknown, or polymorphic malware. Behavioral and heuristic signatures provide additional layers of detection by analyzing patterns of API calls, system behaviours, and rule based or machine learning derived heuristics. The effectiveness of signature
based detection is evaluated against other techniques like anomaly based and hybrid detection. While signature based methods are resource efficient and accurate for known threats, they require frequent updates and are less effective against zero day exploits and sophisticated obfuscation techniques. This study highlights the practical challenges and successes of signature based detection through case studies on notable malware such as WannaCry, Emotet, and polymorphic malware.