Using Entropy Analysis to Find Encrypted and Packed Malware

Authors:
Robert Lyda;James Hamrock
Affiliations:
Sparta;McDonald Bradley
Venue:
IEEE Security and Privacy
Year:
2007

Citing 3
Cited 21

A Toolkit for Detecting and Analyzing Malicious Software

ACSAC '02 Proceedings of the 18th Annual Computer Security Applications Conference
A Mathematical Theory of Communication

A Mathematical Theory of Communication
Coding and Information Theory

Coding and Information Theory

Classification of packed executables for accurate computer virus detection

Pattern Recognition Letters
A Study of the Packer Problem and Its Solutions

RAID '08 Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection
Efficient and Automatic Instrumentation for Packed Binaries

ISA '09 Proceedings of the 3rd International Conference and Workshops on Advances in Information Security and Assurance
A heuristic approach for detection of obfuscated malware

ISI'09 Proceedings of the 2009 IEEE international conference on Intelligence and security informatics
Detecting metamorphic malwares using code graphs

Proceedings of the 2010 ACM Symposium on Applied Computing
Classification of malware using structured control flow

AusPDC '10 Proceedings of the Eighth Australasian Symposium on Parallel and Distributed Computing - Volume 107
Mimimorphism: a new approach to binary code obfuscation

Proceedings of the 17th ACM conference on Computer and communications security
Entropy estimation for real-time encrypted traffic identification

TMA'11 Proceedings of the Third international conference on Traffic monitoring and analysis
Collective classification for packed executable identification

Proceedings of the 8th Annual Collaboration, Electronic messaging, Anti-Abuse and Spam Conference
Evaluation of Encrypted Data Identification Methods Based on Randomness Test

GREENCOM '11 Proceedings of the 2011 IEEE/ACM International Conference on Green Computing and Communications
Comparing files using structural entropy

Journal in Computer Virology
WiSec 2011 poster: context-adaptive entropy analysis as a lightweight detector of zero-day shellcode on mobiles

ACM SIGMOBILE Mobile Computing and Communications Review
PEAL--Packed executable analysis

ADCONS'11 Proceedings of the 2011 international conference on Advanced Computing, Networking and Security
Frankenstein: stitching malware from benign binaries

WOOT'12 Proceedings of the 6th USENIX conference on Offensive Technologies
Improving malware classification: bridging the static/dynamic gap

Proceedings of the 5th ACM workshop on Security and artificial intelligence
ESCAPE: entropy score analysis of packed executable

Proceedings of the Fifth International Conference on Security of Information and Networks
A fine-grained classification approach for the packed malicious code

ICICS'12 Proceedings of the 14th international conference on Information and Communications Security
A static, packer-agnostic filter to detect similar malware samples

DIMVA'12 Proceedings of the 9th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Detection of packed malware

Proceedings of the First International Conference on Security of Internet of Things
Detecting machine-morphed malware variants via engine attribution

Journal in Computer Virology
Binary program statistical features hiding through huffman obfuscated coding

ICIC'13 Proceedings of the 9th international conference on Intelligent Computing Theories

Quantified Score

Hi-index	0.00

Visualization

Abstract

In statically analyzing large sample collections, packed and encrypted malware pose a significant challenge to automating the identification of malware attributes and functionality. Entropy analysis examines the statistical variation in malware executables, enabling analysts to quickly and efficiently identify packed and encrypted samples.