Incremental clustering of malware packers using features based on transformed CFG - Archive ouverte HAL
Pré-Publication, Document De Travail Année : 2022

Incremental clustering of malware packers using features based on transformed CFG

Ludovic Robin
  • Fonction : Auteur
Corentin Jannier
  • Fonction : Auteur
  • PersonId : 1215909
Jean-Yves Marion

Résumé

Packer detection is an important topic because most malware is packed and this allows it to avoid detection based on static analysis. Identifying classes of packers is the key to effective detection because it makes it easier to determine from a static analysis whether further analysis is needed or whether a decision is already possible. Thus in this work we propose new features to cluster packers from their unpacking function. This method makes it possible to effectively cluster packers, and is able, by clustering, to identify packer classes used by malware. It is a step towards a larger data clustering allowing to identify custom packers.

Mots clés

Fichier principal
Vignette du fichier
RobinJannierMarion.pdf (518.92 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03940881 , version 1 (16-01-2023)
hal-03940881 , version 2 (07-03-2023)

Identifiants

  • HAL Id : hal-03940881 , version 1

Citer

Ludovic Robin, Corentin Jannier, Jean-Yves Marion. Incremental clustering of malware packers using features based on transformed CFG. 2022. ⟨hal-03940881v1⟩
129 Consultations
172 Téléchargements

Partager

More