Hidden Markov Model(HMM) is a pattern recognition technique which can be used to detect metamorphic malware. Recently, lot of research has been going on to enhance this technique [2, 3, 8, 30, 31]. Sridhara  describes a method to train HMM against opcode sequence extracted from the given malware family. This HMM model is used to score the files and classify whether a file belongs to the given malware family. If the score is greater than a predefined threshold, then it is concluded that the file belongs to a given malware family. Scores are measured in terms of Log Likelihood Per Opcode (LLPO).
Lastly, we turn to the NGVCK virus family, which  found to be the most highly metamorphic. Our first observation is that files in this sample differ in size. This is unlike the G2 and MWOR test data where all the files within each set have the same size. Out of the 50 NGVCK files in our test set, 34 files are 4 kilobytes in size, 13 files are 8 kilobytes, and the other three files are 16, 36, and 40 kilobytes (KB). First, we ran a similarity test between the 34 NGVCK files (4 KB) and a set of Cygwin files listed in Table 3. The plot is shown in Figure 14. While the average similarity score of the virus pairs came out high at 90.31%, there are a number of overlaps among the virus and benign file comparisons. If we take the minimum score from the virus pair comparisons and set it as the threshold, 1.5% of the virus and benign pairs score higher than the threshold.
A metamorphic virus can mutate itself at each infection such that each copy is different from the other but essentially performs the same malicious actions. Such viruses employ various techniques to change and obfuscate virus body such as in- struction reordering, garbage code insertion, register swapping, and so on. These mutations make it harder to detect metamorphic viruses.
Metamorphic testing  involves generating new test cases from existing ones, where the expected result of a new test case can be generated from the result of an existing test via a metamorphic relation. By comparing the results of the original test with the new one we can identify cases where the metamorphic relations are broken, indicating the presence of errors in the implementation. As an illustrative example in the context of a constraint satisfaction problem (CSP), given any unsolvable CSP, adding a constraint or removing domain values from a variable should result in another unsolvable CSP. 1
Figure 5-3: Monazite age-trend diagram for all regions. Horizontal lines show the weighted mean age for the Cambrian metamorphic event (see text) and for the largest peak in the Mesoproterozoic (see text and figure 5-4). Note “gaps” in the data at ~ 400 Ma, 825 Ma, and 950 Ma. Note also the lesser gap associated with the sharp bend in the in slope of the data at ~600 Ma (inset—dashed line), and the gentle bends in the trend of the data at ~1,000, 1,100, 1,200, and 1,290 Ma.
Anti-virus techniques include both static and dynamic approaches . These techniques have relative weaknesses and strengths and the effective combination of these techniques can yield stronger detection. Scanners, Static Heuristics and Integrity Checkers form the static approach whereas Behavior Monitors and Emulation form the dynamic approach in anti-virus techniques. Signature detection is the most common method implemented in anti-virus products . A signature is essentially a “bit pattern” which is characteristic of a given virus family . Ideally, the signature is not common in other software. Signature detection is relatively fast and effective, but it cannot detect new and unknown viruses, since signatures must be available prior to the detection. Since signature detection is the most popular technique, virus writers have developed many innovative techniques to evade signature detection. The most advanced such technique is the use of metamorphic code that has the ability to morph its internal structure (but retain its function) at each infection. Well designed metamorphic viruses cannot be detected using signatures, since there is no common signature available.
technique involves observing the switch in the asymmetry of curved inclusion trails, preserved in porphyroblasts in a series of vertically oriented thin sections with different strike viewed in the one direction around the compass from the same sample (Fig. 6). Initially six vertical thin sections from a horizontal oriented block are required for a FIA trend determination cut 30 ° apart around the compass (i.e. trending 00 ° , 30 ° , 60 ° , 90 ° , 120 ° and 150 ° ). An additional two vertical sections were cut 10 ° apart between the two sections in which the switch in inclusion trail asymmetry was observed to narrow the location of the FIA within a 10° range. Using multiple vertical thin sections approach was preferred because it has a very significant microstructural advantage. The inclusion trails contained in many porphyroblasts can be observed from a large range of orientations, providing a much clearer record of the inclusion trail geometry and deformation history. The P (thin section cut parallel to lineation and perpendicular to foliation)-N (thin section cut perpendicular to lineation and foliation) section approach used by most structural and metamorphic geologists over the past decades results in misinterpretation of the timing of porphyroblast growth and multiple deformational, metamorphic and tectonic events in highly tectonized terranes (for detail see Cihan, 2004).
I especially want to thank my colleagues in Structural and Metamorphic Research Institute (SAMRI) at James Cook University for providing the most multi- cultural and enjoyable workplace. In particular, I would like to thank Afroz Shah (India), Ahmed Abusharib (Egypt), Clement Fay (France), Chris Fletcher (Australia), Hui Cao (China), Ioan Vasile Sanislav (Romania), Jyotindra Sapkota (Nepal), Matt Bruce (Australia), Mark Rieuwers (Australia), Raphael Quentin de Gromard (France), Shyam Ghimire (Nepal) and their partners.
These dikes in terms of petrology include andesitic basalt, basaltic andesite and andesite. Their texture is Por- phyritic, Hyalo porphyritic with microlitic pulp and sometimes glomeroporphyritic. Plagioclase Phenocrysts with a combination of Andesine (An% = 42.59) to labradorite (An% = 50.73) semi-shaped to self-shaped make their coarsely crystals (Figure 3(a) and Figure 3(b)). Some of them are quite normal and have zoning (An% = 47.77 - 50.5) (Figure 3(c)) with inclusions of biotite. Plagioclase strongly altered and changed to sericite.
The Collingwood River region (Figure 2-1) is intensely faulted and contains the highest-grade regional metamorphic rocks in Tasmania. It includes several different rock types, including pelitic schists, eclogite, phyllites, and whiteschist, all of which are interlayered or in blocky fault-bounded segments. This project focuses on two areas within the region—the “north block”, located in the area wherein both the Collingwood River and Lyell Highway run nearly east-west (Figure 2-1B) for a roughly 3 km stretch, and the “south block”, located where the river and road run generally northwest-southeast (Figure 2-1E) for five km. In general, the north block units are coarser-grained than their south block counterparts, and the south block pelitic rocks are more micaceous than are the northern block pelites. The pelitic schists, quartzites, and minor amphibolites and eclogites, of the Collingwood River area were called the Franklin Group schists by Spry (1962), and various publications based upon that research. Spry’s map of the Frenchman’s Cap area shows the Franklin Group throughout this region, including both “northern” and “southern” blocks as described above. The more recent nomenclature for this area is the Franklin Metamorphic Complex (e.g. Meffre et al. 2000).
Of specific interest for geothermometric and barometric applications is also the estimation of Mg-Fe partitioning between coexisting pyroxenes and between pyroxenes and other phases in MFS and CMFS systems. Since Ramberg and Devore (1951) and Kretz (1961) proved that Mg-Fe distributions in pyroxenes from igneous and metamorphic rocks are different, many studies have been conducted to quantitatively determine and to thermodynamically model such partitioning, aiming to obtain information on pressure and temperature of pyroxene crystallization (e.g. Nafziger and Muan, 1967; Kitayama and Katsura, 1968; Matsui and Nishizawa, 1974; Bohlen and Boettcher, 1981; Adams and Bishop, 1986; Davidson and Lindsley, 1989; Sack and Ghiorso, 1989; Koch-Müller et al., 1992; von Seckendorff and O’Neill; 1993 Kawasaki and Ito, 1994; Kawasaki, 1999). In addition, the intracrystalline Mg-Fe partitioning between M2 and M1 sites in both ortho- and clinopyroxene solid solutions has also been the subject of numerous investigations. Order-disorder Mg-Fe phenomena depend on the mineral’s crystallization temperature, therefore, they represent a useful tool to investigate the thermal history of pyroxene-bearing rocks. Many experimental studies have been conducted to determine the intracrystalline partition coefficient ( ( ) ( M 1 ) M 2 )
Varne & Rubenach (1972) presented new maps and geological data showing that Macquarie Island seems to be composed of a number of faultbounded blocks, probably on all scales, derived from different layers of the oceanic lithosphere. This interpretation implies that all of the igneous rocks of the island could have been formed at much the same time, in a spreading zone in an oceanic environment, possibly the Indian-Antarctic spreading ridge. Poorly-preserved coccoliths recovered from oozes associated with North Head pillow lavas were identified by Quilty et al. ( 1973) as being of Early or Middle Miocene age.
The Hezar Igneous Complex (HIC) in the south-eastern part of Urumieh-Dokhtar magmatic arc, is the most prominent magmatic feature in the Kerman Porphyry Copper Belt, that understanding magmatic evolution of which may shed light on the tectonomagmatic development of this less-studied part of an important magmatic arc in the Neotethys realm. The HIC has been developed in the the intersection of the NS- striking Sabzevaran fault and the NW-SE striking Rafsanjan-Rayen fault. It is indicated that the possible place of the conduit and vent is in Jalas Mountain which has been splitted later by the Sabzevaran fault into Minor and Major Jalas. The current summit had been constructed by ascending magma chamber under the HIC that constitutes the Kamali Mountain at the south of the summit. Some plutonic rocks of the HIC are exposed at Kamali Mountain. The subalkaline rocks of this complex mainly are composed of different pyroclastic and lava flow rocks, acidic to basic in composition, showing the evidences of fractional crystallization and mineral segregation. Sequential explosive and effusive eruptions with Strombolian to Vulcanian types are evident in the successive volcanic layers. The compositional trend shows the melting of spinel lherzolite, not garnet lherzolite. The subduction-related mechanism of the magma genesis has been indicated by IAB nature of the magma formation in geochemical diagrams.