NDLI: Entropy analysis to classify unknown packing algorithms for malware detection

Content Provider	Springer Nature Link
Author	Bat Erdene, Munkhbayar Park, Hyundo Li, Hongzhe Lee, Heejo Choi, Mahn Soo
Copyright Year	2016
Abstract	The proportion of packed malware has been growing rapidly and now comprises more than 80 % of all existing malware. In this paper, we propose a method for classifying the packing algorithms of given unknown packed executables, regardless of whether they are malware or benign programs. First, we scale the entropy values of a given executable and convert the entropy values of a particular location of memory into symbolic representations. Our proposed method uses symbolic aggregate approximation (SAX), which is known to be effective for large data conversions. Second, we classify the distribution of symbols using supervised learning classification methods, i.e., naive Bayes and support vector machines for detecting packing algorithms. The results of our experiments involving a collection of 324 packed benign programs and 326 packed malware programs with 19 packing algorithms demonstrate that our method can identify packing algorithms of given executables with a high accuracy of 95.35 %, a recall of 95.83 %, and a precision of 94.13 %. We propose four similarity measurements for detecting packing algorithms based on SAX representations of the entropy values and an incremental aggregate analysis. Among these four metrics, the fidelity similarity measurement demonstrates the best matching result, i.e., a rate of accuracy ranging from 95.0 to 99.9 %, which is from 2 to 13 higher than that of the other three metrics. Our study confirms that packing algorithms can be identified through an entropy analysis based on a measure of the uncertainty of the running processes and without prior knowledge of the executables.
Starting Page	227
Ending Page	248
Page Count	22
File Format	PDF
ISSN	16155262
Journal	International Journal of Information Security
Volume Number	16
Issue Number	3
e-ISSN	16155270
Language	English
Publisher	Springer Berlin Heidelberg
Publisher Date	2016-05-04
Publisher Place	Berlin, Heidelberg
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Entropy analysis Original entry point (OEP) Symbolic aggregate approximation (SAX) Piecewise aggregate approximation (PAA) Data Encryption Computer Communication Networks Operating Systems Coding and Information Theory Management of Computing and Information Systems Communications Engineering, Networks
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Information Systems Safety, Risk, Reliability and Quality Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Packer Detection for Multi-Layer Executables Using Entropy Analysis

Malware analysis using visualized images and entropy graphs

GPU-assisted malware

A defense framework against malware and vulnerability exploits

A symbolic framework for multi-faceted security protocol analysis

Mobile-Sandbox: combining static and dynamic analysis with machine-learning techniques

Malware detection using bilayer behavior abstraction and improved one-class support vector machines

Token-based graphical password authentication

A method for identifying compromised clients based on DNS traffic analysis

Entropy analysis to classify unknown packing algorithms for malware detection

Similar Documents

Packer Detection for Multi-Layer Executables Using Entropy Analysis

Malware analysis using visualized images and entropy graphs

GPU-assisted malware

A defense framework against malware and vulnerability exploits

A symbolic framework for multi-faceted security protocol analysis

Mobile-Sandbox: combining static and dynamic analysis with machine-learning techniques

Malware detection using bilayer behavior abstraction and improved one-class support vector machines

Token-based graphical password authentication

A method for identifying compromised clients based on DNS traffic analysis

Entropy analysis to classify unknown packing algorithms for malware detection