A control flow graph-based signature for packer identification

Saleh, Moustafa; Ratazzi, E. Paul; Xu, Shouhuai

doi:10.1109/milcom.2017.8170793

Cited by 6 publications

(10 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…a referential of signatures, unlike traditional signature-based approaches that hinge on direct matching unable to capture small differences. The authors of [31] claim their system can identify new packer classes, but do not validate it experimentally. In [23], new custom packers are correctly classified only if the packer uses a set of well-known obfuscation techniques.…”

Section: Related Workmentioning

confidence: 99%

“…Other works [18,23,26,31,32] extracted signatures from the unpacking stub code (see Sec. 2.1), then a similarity metric regroups packers into families.…”

Section: Related Workmentioning

confidence: 99%

“…In [23], new custom packers are correctly classified only if the packer uses a set of well-known obfuscation techniques. Works [18,26,31] can identify new packer classes, but rely on pairwise similarities, while we rely on clustering that adapts itself to packers evolution. Like us, [26] analyze a large dataset of manually and wild packed files, while [18,31] study smaller datasets.…”

Section: Related Workmentioning

confidence: 99%

“…Works [18,26,31] can identify new packer classes, but rely on pairwise similarities, while we rely on clustering that adapts itself to packers evolution. Like us, [26] analyze a large dataset of manually and wild packed files, while [18,31] study smaller datasets. Feature extraction in [26,31] uses recursive traversal disassembly and [18] requires full execution with multiple entropy measurements, whose cost can be prohibitive in our clustering scenario.…”

Section: Related Workmentioning

confidence: 99%

“…Like us, [26] analyze a large dataset of manually and wild packed files, while [18,31] study smaller datasets. Feature extraction in [26,31] uses recursive traversal disassembly and [18] requires full execution with multiple entropy measurements, whose cost can be prohibitive in our clustering scenario.…”

Section: Related Workmentioning

confidence: 99%

See 4 more Smart Citations

Se-Pac

Noureddine

Heuser

Puodzius

et al. 2021

Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy

View full text Add to dashboard Cite

Packers are widespread tools used by malware authors to hinder static malware detection and analysis. Identifying the packer used to pack a malware is essential to properly unpack and analyze the malware, be it manually or automatically. While many wellknown packers are used, there is a growing trend for new custom packers that make malware analysis and detection harder. Research works have been very effective in identifying known packers or their variants, with signature-based, supervised machine learning or similarity-based techniques. However, identifying new packer classes remains an open problem.This paper presents a self-evolving packer classifier that provides an effective, incremental, and robust solution to cope with the rapid evolution of packers. We propose a composite pairwise distance metric combining different types of packer features. We derive an incremental clustering approach able to identify both (variants of) known packer classes and new ones, as well as to update clusters automatically and efficiently. Our system thus continuously enhances, integrates, adapts and evolves packer knowledge. Moreover, to optimize post clustering packer processing costs, we introduce a new post clustering strategy for selecting small subsets of relevant samples from the clusters. Our approach effectiveness and timeresilience are assessed with: 1) a real-world malware feed dataset composed of 16k packed binaries, comprising 29 unique packers, and 2) a synthetic dataset composed of 19k manually crafted packed binaries, comprising 31 unique packers (including custom ones). CCS CONCEPTS• Security and privacy → Malware and its mitigation; • Computing methodologies → Machine learning approaches.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Other works [18,23,26,31,32] extracted signatures from the unpacking stub code (see Sec. 2.1), then a similarity metric regroups packers into families.…”

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 3 more Smart Citations

Se-Pac

Noureddine

Heuser

Puodzius

et al. 2021

Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy

View full text Add to dashboard Cite

show abstract

A survey on run-time packers and mitigation techniques

Alkhateeb,

Ghorbani,

Habibi Lashkari

2023

Int. J. Inf. Secur.

View full text Add to dashboard Cite

A Consistently-Executing Graph-Based Approach for Malware Packer Identification

Li¹,

Shan²,

Chen³

et al. 2019

IEEE Access

View full text Add to dashboard Cite

Packing is the most common malware obfuscation technique employed to evade detection by anti-virus systems. With the explosive growth of packed malware, packer identification has become increasingly important in current cybersecurity. Most prior studies lack resilience since they neglect the significance of preserving the semantic integrity for pursuing efficiency. Therefore, in this paper, we propose a novel approach based on consistently executing graph (CEG) mining, which can maximize semantics and facilitate the execution intents of executables for identification. We elaborate on the concepts of consistent execution and represent malware packers as structured CEGs. Then, we employ the bipartite matching algorithm built on a designed block proximity metric to extract the critical matching subgraphs. Weisfeiler-Lehman shortest path graph kernel is adopted for pairwise comparison to make the prediction. We have evaluated the efficacy extensively with several experiments on large-scale datasets containing manually packed benign apps, wild-packed malware, and wild-unpacked malware. The promising results demonstrate that our approach is valid and practical when applied to real-world packed malware analysis.

show abstract

A control flow graph-based signature for packer identification

Cited by 6 publications

References 10 publications

Se-Pac

Se-Pac

A survey on run-time packers and mitigation techniques

A Consistently-Executing Graph-Based Approach for Malware Packer Identification

Contact Info

Product

Resources

About