Scheirer et al. [36] | Polymorphic worms | Syntactic and Semantic | Detection of many polymorphic worms and uses intrusion detection techniques such as sliding window schemes and instruction semantics. |
Wurzinger et al. [37] | Botnets | Semantic | Detects botnets that are under the influence of botmaster (malicious body) using network signatures by examining the response from a compromised host to a received command and by generating detection models. |
Botzilla [38] | Malware binaries | Semantic | Produces signatures for the malicious activities (traffic) created by a malware binary executed several times within a controlled domain. |
Zhao et al. [39] | General malware datasets | Semantic | Generates signatures through an inverse transcoding method by converting the malware sequential information, such as system call sequences, propagation dataflow, etc. into amino acid sequences and then aligning them using multiple sequence alignment tool. |
ProVex [40] | Botnets | Semantic | Generates signatures to detect botnets that use encrypted command and control (C & C) systems after being given the keys and decryption routine employed by the malware be derived using binary code reuse strategy. |
FIRMA [41] | Botnets | Semantic | Detects C & C systems but does not produce signatures for those. |
Ki et al. [42] | Worms, Trojans, etc. | Semantic | Generates sequences that are typical API call sequence motifs of malicious activities belonging to several malware samples and employed multiple sequence alignment tool to align those malware samples to extract signatures. |
MalGene [43] | Evasive malware samples | Semantic | Uses sequence alignment techniques on two sequences of system call events belonging to two different analysis environments: one environment in which the malware evades the AVS, and the other in which it exhibits the malicious activities. These events are used to construct an “evasion signature” using sequence alignment. |