Abstract: Much of apparently new malware comes from transformed known malware. Metamorphic malware could even complete this process automatically. The mutable signature makes the traditional detection method based on it difficult to detect metamorphic malware. Comb

Key words: Metamorphic malware, Normalization, Malware detection