Scholarlink

<p>Although packers are useful tools for protecting applications, they can also be used to protect malware. This makes packer identification technology increasingly important for malware analysis. Most existing packer identification methods based on static analysis extract a large number of features from the binary code of an executable. However, these binary code-related features are sensitive to small changes in the executable’s binary code, and it is difficult to understand how these features influence the decision-making processes of machine learning models. To address the shortcomings of existing static analysis-based packer identification methods, we explore extraction of a small number of easily extractable and discriminative features for efficient and accurate packer identification. Specifically, we analyze the packing process and notice that the structures of the packed PEs differ according to the different packing patterns used by the packer. Based on this, a section-entropy plot is proposed, which is generated by a small number of easily extractable and discriminative features that can reflect the overall structure of a PE file. By using GoogLeNet to identify the packer characterized by the section-entropy plot, a <i>p</i>acker <i>i</i>dentification method based on the <i>s</i>ection-<i>e</i>ntropy <i>p</i>lot (PISEP) is constructed, which does not require PE file disassembly and complex feature engineering. The experimental results show that PISEP achieves 99.08% accuracy for identifying seen and unseen types of packers and requires only 0.165&#xa0;s on average to identify the packer class of a test sample, and thus could be a highly competitive candidate for packer identification.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

A packer identification method based on section-entropy plot

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年2月16日

查看全文
  • Yueting Wan,
  • Chun Guo,
  • Yuan Ping,
  • Yunhe Cui,
  • Xiaodan Lyu,
  • Guowei Shen

摘要

Although packers are useful tools for protecting applications, they can also be used to protect malware. This makes packer identification technology increasingly important for malware analysis. Most existing packer identification methods based on static analysis extract a large number of features from the binary code of an executable. However, these binary code-related features are sensitive to small changes in the executable’s binary code, and it is difficult to understand how these features influence the decision-making processes of machine learning models. To address the shortcomings of existing static analysis-based packer identification methods, we explore extraction of a small number of easily extractable and discriminative features for efficient and accurate packer identification. Specifically, we analyze the packing process and notice that the structures of the packed PEs differ according to the different packing patterns used by the packer. Based on this, a section-entropy plot is proposed, which is generated by a small number of easily extractable and discriminative features that can reflect the overall structure of a PE file. By using GoogLeNet to identify the packer characterized by the section-entropy plot, a packer identification method based on the section-entropy plot (PISEP) is constructed, which does not require PE file disassembly and complex feature engineering. The experimental results show that PISEP achieves 99.08% accuracy for identifying seen and unseen types of packers and requires only 0.165 s on average to identify the packer class of a test sample, and thus could be a highly competitive candidate for packer identification.