A Study of the Packer Problem and Its Solutions

By F. Guo, Peter Ferrie, Tzi-Cker Chiueh. 2008

200 citations recorded by the source corpus.

Subfields: Information Systems, Software, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Software

In Signal Processing

Citations in the corpus

Poisoning behavioral malware clustering (2014, background): “…is motivated by a key assumption: albeit malware writers can generate a large number of polymorphic variants of the same malware, e.g., using executable packing and other code obfuscation techniques [12, 15], these polymorphic variants will eventually perform similar activities when executed.”
Malware Detection by Eating a Whole EXE (2017, background): “However, packing alone is not a reliable malware indicator, as many benign applications are also packed (Guo, Ferrie, and Chiueh 2008).”
AppSpear: Bytecode Decrypting and DEX Reassembling for Packed Android Malware (2015, background): “The topic of code packing have been thoroughly studied in the literature, and several solutions have been proposed for code unpacking [13].”
VAMO: towards a fully automated malware clustering validity analysis (2012, background): “Due to the extensive use of packing and other code obfuscation techniques [6], the number of new malware samples collected by anti-virus 1 (AV) vendors has grown enormously in recent years, reaching tens or even hundreds of thousand of new malware samples collected per day (e.g., in 2010 Symantec…”
DUET: integration of dynamic and static analyses for malware clustering with cluster ensembles (2013, methodology): “In DUET-S , we tailored a generic unpacking algorithm proposed in [13] for eﬃcient malware clustering by exploiting the observation that, for static analysis, DUET-S need not guarantee the executability of unpacked programs as long as the original instructions can be inspected and features…”
BitShred: feature hashing malware for scalable triage and semantic analysis (2011, background): “Our work builds on per-sample analysis and feature extraction, which is an extremely active area of research including unpacking research [18, 20, 27, 33, 35], and even entire conferences like DIMVA.”
Scalable fine-grained behavioral clustering of HTTP-based malware (2013, methodology): “To make AV detection harder, malware writers commonly employ executable packing [16] and other automatic code obfuscation techniques to generate large numbers of polymorphic variants of the same malware [35] that appear syntactically different from each other while remaining semantically similar, so”
Large-scale malware indexing using function-call graphs (2009, methodology): “To improve SMIT s unpacking capabilities, we plan to incorporate generic unpackers, such as OmniUnpack [22] and Justin [12], which execute malware samples, detect the end of unpacking and then dump the process image at that instant.”
Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces (2010, methodology): “We implemented a proof-of-concept version of our network-level malware clustering system and performed experiments with more than 25,000 distinct malware samples.”