Which term describes the ability of malware to change its identifiable features to evade signature-based detection?

Which term describes the ability of malware to change its identifiable features to evade signature-based detection?

• A. Obfuscation
• B. Polymorphism
• C. Evasion
• D. Stealth

Answer: (B)

Polymorphism is the technique where malware alters its own appearance while keeping the same functionality, so each instance looks different to signature-based detectors. By changing the code layout or using different encryption keys and decryptors, the identifiable patterns—the signatures that security tools scan for—vary with each infection. This directly defeats static signature matching, which relies on comparing known byte patterns. Obfuscation hides clarity of the code but doesn’t guarantee a new, distinct signature in the same automated way, stealth is about remaining hidden rather than frequently changing detectable features, and evasion is a broad term for avoiding detection without specifying how the changes occur.

Polymorphism is the technique where malware alters its own appearance while keeping the same functionality, so each instance looks different to signature-based detectors. By changing the code layout or using different encryption keys and decryptors, the identifiable patterns—the signatures that security tools scan for—vary with each infection. This directly defeats static signature matching, which relies on comparing known byte patterns. Obfuscation hides clarity of the code but doesn’t guarantee a new, distinct signature in the same automated way, stealth is about remaining hidden rather than frequently changing detectable features, and evasion is a broad term for avoiding detection without specifying how the changes occur.