Using Entropy Analysis to Find Encrypted and Packed Malware

By R. Lyda, J. Hamrock. IEEE Security and Privacy, 2007

388 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data (2016, background): “Others have previously proposed the use of entropy in the space of malware detection [42], [39], [31], however these works focus on classifying the malware sample and not on indicating user data transformation.”
Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification (2015, background): “Entropy ( ENT ) is a measure of the amount of disorder , and can be used to detect the possible presence of obfuscation [31, 10].”
Prevalence and Impact of Low-Entropy Packing Schemes in the Malware Ecosystem (2020, background): “As a result, researchers (such as in [26], [33], [39], [48], [34], [47]) continued to resort to entropy-based metrics and static signatures to identify the presence of packing.”
Classification of malware using structured control flow (2010, methodology): “Entropy analysis (Lyda and Hamrock 2007), is used to identify packed binaries.”