SE-PAC: A Self-Evolving PAcker Classifier against rapid packers evolution - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2021

SE-PAC: A Self-Evolving PAcker Classifier against rapid packers evolution

Abstract

Packers are widespread tools used by malware authors to hinder static malware detection and analysis. Identifying the packer used to pack a malware is essential to properly unpack and analyze the malware, be it manually or automatically. While many well-known packers are used, there is a growing trend for new custom packers that make malware analysis and detection harder. Research works have been very effective in identifying known packers or their variants, with signature-based, supervised machine learning or similarity-based techniques. However, identifying new packer classes remains an open problem. This paper presents a self-evolving packer classifier that provides an effective, incremental, and robust solution to cope with the rapid evolution of packers. We propose a composite pairwise distance metric combining different types of packer features. We derive an incremental clustering approach able to identify both (variants of) known packer classes and new ones, as well as to update clusters automatically and efficiently. Our system thus continuously enhances, integrates, adapts and evolves packer knowledge. Moreover, to optimize post clustering packer processing costs, we introduce a new post clustering strategy for selecting small subsets of relevant samples from the clusters. Our approach effectiveness and time-resilience are assessed with: 1) a real-world malware feed dataset composed of 16k packed binaries, comprising 29 unique packers, and 2) a synthetic dataset composed of 19k manually crafted packed binaries, comprising 31 unique packers (including custom ones).
Fichier principal
Vignette du fichier
SE-PAC.pdf (1.43 Mo) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03149211 , version 1 (22-02-2021)

Identifiers

Cite

Lamine Noureddine, Annelie Heuser, Cassius Puodzius, Olivier Zendra. SE-PAC: A Self-Evolving PAcker Classifier against rapid packers evolution. CODASPY '21 - 11th ACM Conference on Data and Application Security and Privacy, Apr 2021, Virtual Event, United States. pp.1-12, ⟨10.1145/3422337.3447848⟩. ⟨hal-03149211⟩
307 View
724 Download

Altmetric

Share

Gmail Mastodon Facebook X LinkedIn More