A Compact Multi-Step Framework for Packing Identification in Portable Executable Files for Malware Analysis

Abstract

Packing presents a formidable challenge in the cybersecurity domain, significantly complicating malware analysis and prolonging the lifespan of malicious software. Malicious software frequently utilizes anti-analysis technologies to circumvent antivirus programs and analysis tools. Moreover, the process of training malware classifiers often leads to the acquisition of packer characteristics rather than those of the malware itself, thereby engendering an adversarial example or generalization error. This study seeks to address this problem by introducing a streamlined framework with 20 optimal features for the detection of packing and the identification of packers in portable executable (PE) files. Furthermore, the study proposes the framework for an optimal model capable of detecting packed samples and identifying the signatures of packers based on their unique patterns. This paper outlines an exhaustive experimental phase aimed at ascertaining the most optimal model and features for the proposed framework. The XGBoost model learnt 20 features and demonstrated outstanding performance (99.27% accuracy, 98.84% F1-Score), surpassing that reported in a recent study. Furthermore, through this study, an accessible dataset, comprising 213,784 samples and 125 features, is made available to researchers focused on packing or the development of malware classifiers.