Defeating Anti-Debugging Techniques for Malware Analysis Using a Debugger

Kim, Jong-Wouk; Bang, Jiwon; Choi, Mi-Jung

doi:10.25046/aj0506142

Cited by 1 publication

(2 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Within the CART algorithm (Algorithm 1), the feature leading to a substantial decrease in Gini impurity is selected at the algorithm's sixth line. The algorithm terminates under the following conditions: (1) absence of remaining data; (2) uniformity of data within a node with respect to a specific feature; (3) data count within a node falling below a predetermined threshold; and (4) tree depth surpassing a specified limit. data".…”

Section: Classification and Regression Trees (Cart) Algorithmmentioning

confidence: 99%

See 1 more Smart Citation

A Compact Multi-Step Framework for Packing Identification in Portable Executable Files for Malware Analysis

Kim,

Moon,

Choi

2024

Preprint

Self Cite

View full text Add to dashboard Cite

Packing presents a formidable challenge in the cybersecurity domain, significantly complicating malware analysis and prolonging the lifespan of malicious software. Malicious software frequently utilizes anti-analysis technologies to circumvent antivirus programs and analysis tools. Moreover, the process of training malware classifiers often leads to the acquisition of packer characteristics rather than those of the malware itself, thereby engendering an adversarial example or generalization error. This study seeks to address this problem by introducing a streamlined framework with 20 optimal features for the detection of packing and the identification of packers in portable executable (PE) files. Furthermore, the study proposes the framework for an optimal model capable of detecting packed samples and identifying the signatures of packers based on their unique patterns. This paper outlines an exhaustive experimental phase aimed at ascertaining the most optimal model and features for the proposed framework. The XGBoost model learnt 20 features and demonstrated outstanding performance (99.27% accuracy, 98.84% F1-Score), surpassing that reported in a recent study. Furthermore, through this study, an accessible dataset, comprising 213,784 samples and 125 features, is made available to researchers focused on packing or the development of malware classifiers.

show abstract

Section: Classification and Regression Trees (Cart) Algorithmmentioning

confidence: 99%

“…Advanced analysis further delves into malware intricacies using debuggers to meticulously scrutinize malware aspects such as behavior, memory utilization, register states, interactions with the registry, and other relevant factors [2].…”

Section: Introductionmentioning

confidence: 99%

A Compact Multi-Step Framework for Packing Identification in Portable Executable Files for Malware Analysis

Kim,

Moon,

Choi

2024

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

Defeating Anti-Debugging Techniques for Malware Analysis Using a Debugger

Cited by 1 publication

References 25 publications

A Compact Multi-Step Framework for Packing Identification in Portable Executable Files for Malware Analysis

A Compact Multi-Step Framework for Packing Identification in Portable Executable Files for Malware Analysis

Contact Info

Product

Resources

About