<p>Nowadays, there are millions of executable files submitted to anti-virus companies every day. Existing anti-virus tools are basically designed on malware signature methods, which could be easily bypassed by malware using obfuscation techniques like packing algorithms. At the same time, we could not manually unpack all of the suspicious files when there was a booming growth of packed malware samples. To overcome these challenges, we designed the P2U(Packed-to-Unpacking) model and S2S(Self-to-Self) model for extracting the unpacking feature and latent feature representation of the program itself, respectively, and then presented an end-to-end packing detection method. Unlike entropy or heuristics features, the features extracted by the autoencoders are difficult to be confused and forged, with no need for manual feature selection, and can be used as a complement to existing features. We trained the models on the manually packed dataset and tested the performance on the real-world dataset. Experimental results show that the F1 scores are 0.99 and 0.89 on the training set and the large-scale real-world packed dataset. In addition, the PackingHunt model is also robust against the unseen packers of our real-world dataset and could even achieve 100% accuracy on some unseen packers, though these packing algorithms are not present in the training set.</p>

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

An end-to-end packing detection method based on autoencoder features

  • Guga Suri,
  • Rui Zheng,
  • Jianming Fu,
  • Bowen Li

摘要

Nowadays, there are millions of executable files submitted to anti-virus companies every day. Existing anti-virus tools are basically designed on malware signature methods, which could be easily bypassed by malware using obfuscation techniques like packing algorithms. At the same time, we could not manually unpack all of the suspicious files when there was a booming growth of packed malware samples. To overcome these challenges, we designed the P2U(Packed-to-Unpacking) model and S2S(Self-to-Self) model for extracting the unpacking feature and latent feature representation of the program itself, respectively, and then presented an end-to-end packing detection method. Unlike entropy or heuristics features, the features extracted by the autoencoders are difficult to be confused and forged, with no need for manual feature selection, and can be used as a complement to existing features. We trained the models on the manually packed dataset and tested the performance on the real-world dataset. Experimental results show that the F1 scores are 0.99 and 0.89 on the training set and the large-scale real-world packed dataset. In addition, the PackingHunt model is also robust against the unseen packers of our real-world dataset and could even achieve 100% accuracy on some unseen packers, though these packing algorithms are not present in the training set.