Assessing static and dynamic features for packing detection

Lucca, Serena;Wauters, Dimitri;Bertrand Van Ouytsel, Charles-Henry;Legay, Axel
(2024) The Combined Power of Research, Education, and Dissemination — ISBN: [978-3-031-73887-6], 146-166, accepted/in-press

Files

Assessing_static_and_dynamic_features_for_packing_detection.pdf
  • Open Access
  • Adobe PDF
  • 1.21 MB
Download

Details

Authors
Abstract
Packing is a widely used obfuscation technique for malware to bypass detection tools and hinder reverse engineering. Existing research has already covered methods to detect packing, both with static and dynamic analysis. These methods are based on various features: headers, entropy, API calls, section permissions, etc. While dynamic features are generally more informative, their contribution compared to static features is not always clear. This paper compares the impact of these static and dynamic features on different machine learning classifiers. We propose a study on different datasets to determine whether the information provided by dynamic analysis outweighs its significant extraction time.
Affiliations

Citations

  • APA
  • Chicago
  • FWB

Lucca, S., Wauters, D., Bertrand Van Ouytsel, C.-H., & Legay, A. (2024). Assessing static and dynamic features for packing detection. In Mike Hinchey, Bernhard Steffen (eds.) (ed.), The Combined Power of Research, Education, and Dissemination (pp. 146-166). Springer Cham. https://hdl.handle.net/2078.5/234544