Classification of metamorphic virus using n-grams signatures

Metamorphic virus has a capability to change, translate, and rewrite its own code once infected the system to bypass detection. The computer system then can be seriously damage by this undetected metamorphic virus. Due to this, it is very vital to design a metamorphic virus classification model that can detect this virus. This paper focused on detection of metamorphic virus using Term Frequency Inverse Document Frequency (TF-IDF) technique. This research was conducted using Second Generation virus dataset. The first step is the classification model to cluster the metamorphic virus using TF-IDF technique. Then, the virus cluster is evaluated using Naïve Bayes algorithm in terms of accuracy using performance metric. The types of virus classes and features are extracted from bi-gram assembly language. The result shows that the proposed model was able to classify metamorphic virus using TF-IDF with optimal number of virus class with average accuracy of 94.2%

Virus taxonomy: the database of the International Committee on Taxonomy of Viruses (ICTV)

The International Committee on Taxonomy of Viruses (ICTV) is charged with the task of developing, refining, and maintaining a universal virus taxonomy. This task encompasses the classification of virus species and higher-level taxa according to the genetic and biological properties of their members; naming virus taxa; maintaining a database detailing the currently approved taxonomy; and providing the database, supporting proposals, and other virus-related information from an open-access, public web site. The ICTV web site (http://ictv.global) provides access to the current taxonomy database in online and downloadable formats, and maintains a complete history of virus taxa back to the first release in 1971. The ICTV has also published the ICTV Report on Virus Taxonomy starting in 1971. This Report provides a comprehensive description of all virus taxa covering virus structure, genome structure, biology and phylogenetics. The ninth ICTV report, published in 2012, is available as an open-access online publication from the ICTV web site. The current, 10th report (http://ictv.global/report/), is being published online, and is replacing the previous hard-copy edition with a completely open access, continuously updated publication. No other database or resource exists that provides such a comprehensive, fully annotated compendium of information on virus taxa and taxonomy

Unveiling Zeus

Malware family classification is an age old problem that many Anti-Virus (AV) companies have tackled. There are two common techniques used for classification, signature based and behavior based. Signature based classification uses a common sequence of bytes that appears in the binary code to identify and detect a family of malware. Behavior based classification uses artifacts created by malware during execution for identification. In this paper we report on a unique dataset we obtained from our operations and classified using several machine learning techniques using the behavior-based approach. Our main class of malware we are interested in classifying is the popular Zeus malware. For its classification we identify 65 features that are unique and robust for identifying malware families. We show that artifacts like file system, registry, and network features can be used to identify distinct malware families with high accuracy---in some cases as high as 95%.Comment: Accepted to SIMPLEX 2013 (a workshop held in conjunction with WWW 2013

Recombination confounds the early evolutionary history of human immunodeficiency virus type 1: Subtype G is a circulating recombinant form

Human immunodeficiency virus type I (HIV-1) is classified in nine subtypes (A to D, F, G, H, J, and K), a number of subsubtypes, and several circulating recombinant forms (CRFs). Due to the high level of genetic diversity within HIV-1 and to its worldwide distribution, this classification system is widely used in fields as diverse as vaccine development, evolution, epidemiology, viral fitness, and drug resistance. Here, we demonstrate how the high recombination rates of HIV-1 may confound the study of its evolutionary history and classification. Our data show that subtype G, currently classified as a pure subtype, has in fact a recombinant history, having evolved following recombination between subtypes A and J and a putative subtype G parent. In addition, we find no evidence for recombination within one of the lineages currently classified as a CRF, CRF02 -AG. Our analysis indicates that CRF02_AG was the parent of the recombinant subtype G, rather than the two having the opposite evolutionary relationship, as is currently proposed. Our results imply that the current classification of HIV-1 subtypes and CRFs is an artifact of sampling history, rather than reflecting the evolutionary history of the virus. We suggest a reanalysis of all pure subtypes and CRFs in order to better understand how high rates of recombination have influenced HIV-1 evolutionary history.</p

Cryoglobulinaemic vasculitis: classification and clinical and therapeutic aspects

Cryoglobulinaemia may cause cutaneous vasculitis and glomerulonephritis, potentially leading to end stage renal failure. An important proportion of cryoglobulinaemias are secondary to hepatitis C virus infection. Emerging antiviral treatment options offer a chance for causal therapy of these cases of cryoglobulinaemia. This review summarises the classification and clinical and therapeutic aspects of cryoglobulinaemic vasculitis and glomerulonephritis

Full Genome Characterization of the Culicoides-Borne Marsupial Orbiviruses: Wallal Virus, Mudjinbarry Virus and Warrego Viruses

Viruses belonging to the species Wallal virus and Warrego virus of the genus Orbivirus were identified as causative agents of blindness in marsupials in Australia during 1994/5. Recent comparisons of nucleotide (nt) and amino acid (aa) sequences have provided a basis for the grouping and classification of orbivirus isolates. However, full-genome sequence data are not available for representatives of all Orbivirus species. We report full-genome sequence data for three additional orbiviruses: Wallal virus (WALV); Mudjinabarry virus (MUDV) and Warrego virus (WARV). Comparisons of conserved polymerase (Pol), sub-core-shell 'T2' and core-surface 'T13' proteins show that these viruses group with other Culicoides borne orbiviruses, clustering with Eubenangee virus (EUBV), another orbivirus infecting marsupials. WARV shares <70% aa identity in all three conserved proteins (Pol, T2 and T13) with other orbiviruses, consistent with its classification within a distinct Orbivirus species. Although WALV and MUDV share <72.86%/67.93% aa/nt identity with other orbiviruses in Pol, T2 and T13, they share >99%/90% aa/nt identities with each other (consistent with membership of the same virus species - Wallal virus). However, WALV and MUDV share <68% aa identity in their larger outer capsid protein VP2(OC1), consistent with membership of different serotypes within the species - WALV-1 and WALV-2 respectively

Genetic Characterization of the Tick-Borne Orbiviruses

The International Committee for Taxonomy of Viruses (ICTV) recognizes four species of tick-borne orbiviruses (TBOs): Chenuda virus, Chobar Gorge virus, Wad Medani virus and Great Island virus (genus Orbivirus, family Reoviridae). Nucleotide (nt) and amino acid (aa) sequence comparisons provide a basis for orbivirus detection and classification, however full genome sequence data were only available for the Great Island virus species. We report representative genome-sequences for the three other TBO species (virus isolates: Chenuda virus (CNUV); Chobar Gorge virus (CGV) and Wad Medani virus (WMV)). Phylogenetic comparisons show that TBOs cluster separately from insect-borne orbiviruses (IBOs). CNUV, CGV, WMV and GIV share low level aa/nt identities with other orbiviruses, in 'conserved' Pol, T2 and T13 proteins/genes, identifying them as four distinct virus-species. The TBO genome segment encoding cell attachment, outer capsid protein 1 (OC1), is approximately half the size of the equivalent segment from insect-borne orbiviruses, helping to explain why tick-borne orbiviruses have a ~1 kb smaller genome

"Virus hunting" using radial distance weighted discrimination

Motivated by the challenge of using DNA-seq data to identify viruses in human blood samples, we propose a novel classification algorithm called "Radial Distance Weighted Discrimination" (or Radial DWD). This classifier is designed for binary classification, assuming one class is surrounded by the other class in very diverse radial directions, which is seen to be typical for our virus detection data. This separation of the 2 classes in multiple radial directions naturally motivates the development of Radial DWD. While classical machine learning methods such as the Support Vector Machine and linear Distance Weighted Discrimination can sometimes give reasonable answers for a given data set, their generalizability is severely compromised because of the linear separating boundary. Radial DWD addresses this challenge by using a more appropriate (in this particular case) spherical separating boundary. Simulations show that for appropriate radial contexts, this gives much better generalizability than linear methods, and also much better than conventional kernel based (nonlinear) Support Vector Machines, because the latter methods essentially use much of the information in the data for determining the shape of the separating boundary. The effectiveness of Radial DWD is demonstrated for real virus detection.Comment: Published at http://dx.doi.org/10.1214/15-AOAS869 in the Annals of Applied Statistics (http://www.imstat.org/aoas/) by the Institute of Mathematical Statistics (http://www.imstat.org