TAILIEUCHUNG - A statistical approach for packer identification

This paper studies the new approach of applying a statistical approach to tackle this problem. We propose a new weight for extracting what obfuscation techniques might be more favourable in packers. We call it obfuscation technique frequency-inverse packer frequency. | Journal of Science and Technology 54 (3A) (2016) 129-139 A STATISTICAL APPROACH FOR PACKER IDENTIFICATION Nguyen Minh Hai, Quan Thanh Tho* Faculty of Computer Science and Engineering, HCM City University of Technology 268 Ly Thuong Kiet Street, Ward 14, District 10, Ho Chi Minh city, Vietnam * Email: qttho@ Received: 15 June 2016; Accepted for publication: 28 July 2016 ABSTRACT Most of modern malware are packed by packers which automatically generate a lot of obfuscation techniques to defeat the anti-virus software. To identify packer, most of industry approaches still adopt the well-known technique of signature matching which can be easily evaded. This paper studies the new approach of applying a statistical approach to tackle this problem. We propose a new weight for extracting what obfuscation techniques might be more favourable in packers. We call it obfuscation technique frequency-inverse packer frequency ( ). As the term implies, calculates values for each obfuscation techniques in a packer through an inverse proportion of the frequency of the obfuscation technique in a particular packer to the percentage of packers the obfuscation technique appears in. Obfuscation techniques with high value show a strong relationship with the packer they appear in. Based on this weight, packer is represented by a vector of . Then the used packer is identified by measuring the similarity between vectors of packer and targeted file. For checking the accuracy of our approach, we have performed the experiments of identifying packer on 200 real-world malware for comparing between our approach with the binary signature technique adopted in CFF Explorer. The result shows that our technique produces the better detection. Keywords: concolic testing, packer, malware analysis, tf-idf, obfuscation techniques. 1. INTRODUCTION Modern popular malwares are packed or obfuscated by packer to generate new invariants. According to [1, 2], 80 % of malware is packed by many .

• Hoá học
• Journal of Science and Technology
• A statistical approach for packer identification
• The anti virus software
• Technique frequency inverse
• Defeat the anti virus software
• Journal of Marine science and Technology
• Marine science and Technology
• Marine science and Technology no 56
• Marine science and Technology year 2018
• Evaluation method
• Electrical energy management model
• Marine science and Technology no 53
• Diesel engines
• Journal of Fisheries science and Technology
• Fisheries science and Technology
• Fisheries science and Technology no 3
• Fisheries science and Technology year 2016
• Striped catfish
• Common carp cyprinus carpio
• Fisheries science and Technology no 4
• Fisheries science and Technology year 2018
• Coastal fi shing activities
• White striped cleaner shrimp
• Journal of Science
• Journal of Technology
• Technology Management
• Science and Technology
• International integration
• Science and Technology Strategy
• Evaluation of science and technology
• Global journal of computer science
• Global journal of computer science and technology
• Information & technology
• GIS based fire emergency response system
• Marine science and technology no 61
• Actual GPS receivers
• Display information on stability
• Nuclear science and technology
• The journal of Nuclear science and technology
• Rotary rack served for elemental concentration
• Seawaterusing co precipitation method
• Natural radionuclides
• Experimental data
• Low energy experiments
• Multigroup cross sections
• Stable isotopic values
• Radial blanket
• Dissolved nitrogen compounds
• Irradiation channels
• Neutron rich nuclei
• Prescila neutron probe
• Full core conversion
• Multipurpose research reactor
• Aquatic environment
• Geochemical parameters
• External reactor vessel cooling method
• Radiation crosslinked scaffolds
• Adipose derived stem cell culture
• Treatment plans
• Minor actinide compositions
• IM NAA of non standard geometrical samples
• Cross shaped obstacle
• University entrepreneurship
• Entrepreneurial research university
• Technology innovation
• Industry university cooperation
• Regional innovation
• Journal of technology and science education
• Bring science and technology closer to secondary school
• Technology closer to secondary school
• Secondary school teachers
• Face to face
• Technology development
• Technology commercialization
• The role of informal science centers in science education
• Informal science center
• Attudes toward science
• Scientfic thinking skills
• Scientific research
• Research quality
• Strategy and policy
• Research Organizations
• Policy Planning
• Science and Technology development
• Theory Z
• Human Resources
• Development policy of Japan
• ‘Standards’ on the bench
• Technological literacy render an adequate image of technology
• Adequate image of technology
• Standards for technological literacy
• Philosophy of technology
• The nature of technology
• Concepts of technology
• Post secondary project based learning in science
• Post secondary project based learning in technology
• Post secondary project based learning in engineering and mathematics
• Post secondary project