Packer detection for multi-layer executables using entropy analysis

Munkhbayar Bat-Erdene, Taebeom Kim, Hyundo Park, Heejo Lee

    Research output: Contribution to journalArticlepeer-review

    13 Citations (Scopus)

    Abstract

    Packing algorithms are broadly used to avoid anti-malware systems, and the proportion of packed malware has been growing rapidly. However, just a few studies have been conducted on detection various types of packing algorithms in a systemic way. Following this understanding, we elaborate a method to classify packing algorithms of a given executable into three categories: single-layer packing, re-packing, or multi-layer packing. We convert entropy values of the executable file loaded into memory into symbolic representations, for which we used SAX (Symbolic Aggregate Approximation). Based on experiments of 2196 programs and 19 packing algorithms, we identify that precision (97.7%), accuracy (97.5%), and recall ( 96.8%) of our method are respectively high to confirm that entropy analysis is applicable in identifying packing algorithms.

    Original languageEnglish
    Article number125
    JournalEntropy
    Volume19
    Issue number3
    DOIs
    Publication statusPublished - 2017 Mar 16

    Keywords

    • Entropy analysis
    • Multi-layer packing
    • Original entry point (OEP)
    • Piecewise aggregate approximation (PAA)
    • Re-packing algorithms
    • Symbolic aggregate approximation (SAX)

    ASJC Scopus subject areas

    • Physics and Astronomy(all)

    Fingerprint

    Dive into the research topics of 'Packer detection for multi-layer executables using entropy analysis'. Together they form a unique fingerprint.

    Cite this