{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,8]],"date-time":"2026-01-08T22:53:16Z","timestamp":1767912796077,"version":"3.49.0"},"reference-count":27,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2017,8,24]],"date-time":"2017-08-24T00:00:00Z","timestamp":1503532800000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Appl Intell"],"published-print":{"date-parts":[[2018,6]]},"DOI":"10.1007\/s10489-017-1045-6","type":"journal-article","created":{"date-parts":[[2017,8,23]],"date-time":"2017-08-23T21:00:34Z","timestamp":1503522034000},"page":"1536-1546","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":13,"title":["An entropy-based distance measure for analyzing and detecting metamorphic malware"],"prefix":"10.1007","volume":"48","author":[{"given":"Esmaeel","family":"Radkani","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sattar","family":"Hashemi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Alireza","family":"Keshavarz-Haddad","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Maryam","family":"Amir Haeri","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2017,8,24]]},"reference":[{"issue":"4","key":"1045_CR1","doi-asserted-by":"crossref","first-page":"179","DOI":"10.1007\/s11416-013-0185-4","volume":"9","author":"D Baysa","year":"2013","unstructured":"Baysa D, Low RM, Stamp M (2013) Structural entropy and metamorphic malware. J Comput Virology Hacking Techniques 9(4):179\u2013192","journal-title":"J Comput Virology Hacking Techniques"},{"key":"1045_CR2","unstructured":"Bruschi D, Martignoni L, Monga M (2006) Using code normalization for fighting self-mutating malware. In: Proceedings of the international symposium on secure software engineering, pp 37\u201344"},{"issue":"1","key":"1045_CR3","doi-asserted-by":"crossref","first-page":"11","DOI":"10.1007\/s11416-013-0189-0","volume":"10","author":"G Canfora","year":"2014","unstructured":"Canfora G, Iannaccone AN, Visaggio CA (2014) Static analysis for the detection of metamorphic computer viruses using repeated-instructions counting heuristics. J Comput Virology and Hacking Techniques 10(1):11\u201327","journal-title":"J Comput Virology and Hacking Techniques"},{"key":"1045_CR4","doi-asserted-by":"crossref","unstructured":"Chouchane MR, Walenstein A, Lakhotia A (2007) Statistical signatures for fast filtering of instruction-substituting metamorphic malware. In: Proceedings of the 2007 ACM workshop on recurring malcode. ACM, pp 31\u201337","DOI":"10.1145\/1314389.1314397"},{"issue":"4","key":"1045_CR5","doi-asserted-by":"crossref","first-page":"522","DOI":"10.1109\/LGRS.2006.878240","volume":"3","author":"B Guo","year":"2006","unstructured":"Guo B, Gunn SR, Damper RI, Nelson JD (2006) Band selection for hyperspectral image classification using mutual information. IEEE Geosci Remote Sens Lett 3(4):522\u2013526","journal-title":"IEEE Geosci Remote Sens Lett"},{"issue":"3","key":"1045_CR6","doi-asserted-by":"crossref","first-page":"265","DOI":"10.1080\/0161-119591883944","volume":"19","author":"T Jakobsen","year":"1995","unstructured":"Jakobsen T (1995) A fast method for cryptanalysis of substitution ciphers. Cryptologia 19(3):265\u2013274","journal-title":"Cryptologia"},{"key":"1045_CR7","doi-asserted-by":"crossref","unstructured":"Lee J, Jeong K, Lee H (2010) Detecting metamorphic malwares using code graphs. In: Proceedings of the 2010 ACM symposium on applied computing. ACM, pp 1970\u20131977","DOI":"10.1145\/1774088.1774505"},{"key":"1045_CR8","doi-asserted-by":"crossref","unstructured":"Maes F, Loeckx D, Vandermeulen D, Suetens P (2015) Image registration using mutual information. In: Handbook of biomedical imaging. Springer, pp 295\u2013308","DOI":"10.1007\/978-0-387-09749-7_16"},{"key":"1045_CR9","doi-asserted-by":"crossref","unstructured":"Nair VP, Jain H, Golecha YK, Gaur MS, Laxmi V (2010) Medusa: Metamorphic malware dynamic analysis usingsignature from api. In: Proceedings of the 3rd international conference on security of information and networks. ACM, pp 263\u2013 269","DOI":"10.1145\/1854099.1854152"},{"key":"1045_CR10","unstructured":"Rad BB, Masrom M (2011) Metamorphic virus variants classification using opcode frequency histogram. arXiv:\n                        1104.3228"},{"key":"1045_CR11","unstructured":"Rad BB, Masrom M, Ibrahim S, Ibrahim S (2011) Morphed virus family classification based on opcodes statistical feature using decision tree. In: Informatics engineering and information science. Springer, pp 123\u2013131"},{"key":"1045_CR12","doi-asserted-by":"crossref","unstructured":"Rogelj P, Kova\u010bi\u010b S (2003) Point similarity measure based on mutual information. In: International workshop on biomedical image registration. Springer, pp 112\u2013121","DOI":"10.1007\/978-3-540-39701-4_12"},{"issue":"1-2","key":"1045_CR13","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1007\/s11416-012-0160-5","volume":"8","author":"N Runwal","year":"2012","unstructured":"Runwal N, Low RM, Stamp M (2012) Opcode graph similarity and metamorphic detection. J Comput Virol 8(1-2):37\u2013 52","journal-title":"J Comput Virol"},{"key":"1045_CR14","doi-asserted-by":"crossref","unstructured":"Russakoff DB, Tomasi C, Rohlfing T, CR Maurer Jr (2004) Image similarity using mutual information of regions. In: Computer vision-ECCV 2004. Springer, pp 596\u2013607","DOI":"10.1007\/978-3-540-24672-5_47"},{"issue":"4","key":"1045_CR15","doi-asserted-by":"crossref","first-page":"191","DOI":"10.1049\/iet-ifs.2010.0136","volume":"5","author":"ME Saleh","year":"2011","unstructured":"Saleh ME, Mohamed AB, Nabi AA (2011) Eigenviruses for metamorphic virus recognition. IET Inf Secur 5(4):191\u2013198","journal-title":"IET Inf Secur"},{"issue":"3","key":"1045_CR16","doi-asserted-by":"crossref","first-page":"159","DOI":"10.1007\/s11416-013-0184-5","volume":"9","author":"G Shanmugam","year":"2013","unstructured":"Shanmugam G, Low RM, Stamp M (2013) Simple substitution distance and metamorphic detection. J Comput Virology Hacking Techniques 9(3):159\u2013170","journal-title":"J Comput Virology Hacking Techniques"},{"key":"1045_CR17","unstructured":"Snakebyte (2000) Next Generation Virus Construction Kit (NGVCK). \n                        http:\/\/vx.netlux.org\/vx.php?id=tn02"},{"issue":"2","key":"1045_CR18","doi-asserted-by":"crossref","first-page":"49","DOI":"10.1007\/s11416-012-0174-z","volume":"9","author":"SM Sridhara","year":"2013","unstructured":"Sridhara SM, Stamp M (2013) Metamorphic worm that carries its own morphing engine. J Comput Virology Hacking Techniques 9(2):49\u201358","journal-title":"J Comput Virology Hacking Techniques"},{"key":"1045_CR19","unstructured":"Sz\u00f6r P, Ferrie P (2001) Hunting for metamorphic. In: Virus bulletin conference"},{"issue":"1","key":"1045_CR20","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/s11416-012-0171-2","volume":"9","author":"AH Toderici","year":"2013","unstructured":"Toderici AH, Stamp M (2013) Chi-squared distance and metamorphic virus detection. J Comput Virology Hacking Techniques 9(1):1\u201314","journal-title":"J Comput Virology Hacking Techniques"},{"key":"1045_CR21","doi-asserted-by":"crossref","unstructured":"Treadwell S, Zhou M (2009) A heuristic approach for detection of obfuscated malware. In: IEEE international conference on intelligence and security informatics, 2009. ISI'09. IEEE, pp 291\u2013 299","DOI":"10.1109\/ISI.2009.5137328"},{"key":"1045_CR22","doi-asserted-by":"crossref","unstructured":"Vinod P, Laxmi V, Gaur M, Chauhan G (2012) Momentum: metamorphic malware exploration techniques using msa signatures. In: 2012 international conference on innovations in information technology (IIT). IEEE, pp 232\u2013237","DOI":"10.1109\/INNOVATIONS.2012.6207739"},{"key":"1045_CR23","doi-asserted-by":"crossref","unstructured":"Viola P, Wells WM (1995) Alignment by maximization of mutual information. In: Proceedings of the fifth international conference on computer vision, 1995. IEEE, pp 16\u201323","DOI":"10.1109\/ICCV.1995.466930"},{"key":"1045_CR24","doi-asserted-by":"crossref","unstructured":"Walenstein A, Mathur R, Chouchane MR, Lakhotia A (2006) Normalizing metamorphic malware using term rewriting. In: Sixth IEEE international workshop on source code analysis and manipulation, 2006. SCAM'06. IEEE, pp 75\u201384","DOI":"10.1109\/SCAM.2006.20"},{"key":"1045_CR25","unstructured":"Wong W (2006) Analysis and detection of metamorphic computer viruses. PhD thesis, San Jose State University"},{"issue":"3","key":"1045_CR26","doi-asserted-by":"crossref","first-page":"211","DOI":"10.1007\/s11416-006-0028-7","volume":"2","author":"W Wong","year":"2006","unstructured":"Wong W, Stamp M (2006) Hunting for metamorphic engines. J Comput Virol 2(3):211\u2013229","journal-title":"J Comput Virol"},{"issue":"1","key":"1045_CR27","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1007\/s11416-012-0175-y","volume":"9","author":"M Xu","year":"2013","unstructured":"Xu M, Wu L, Qi S, Xu J, Zhang H, Ren Y, Zheng N (2013) A similarity metric method of obfuscated malware using function-call graph. J Comput Virology Hacking Techniques 9(1):35\u201347","journal-title":"J Comput Virology Hacking Techniques"}],"container-title":["Applied Intelligence"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s10489-017-1045-6\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10489-017-1045-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10489-017-1045-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2018,5,15]],"date-time":"2018-05-15T04:35:25Z","timestamp":1526358925000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s10489-017-1045-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,8,24]]},"references-count":27,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2018,6]]}},"alternative-id":["1045"],"URL":"https:\/\/doi.org\/10.1007\/s10489-017-1045-6","relation":{},"ISSN":["0924-669X","1573-7497"],"issn-type":[{"value":"0924-669X","type":"print"},{"value":"1573-7497","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,8,24]]}}}