Vol. 8 No. 1 (2023): Proceedings of Botconf 2023
Additional articles

Incremental Clustering of Malware Packers using features based on Transformed CFG

PDF
  • Ludovic Robin
Ludovic Robin
Cyber-Detect

Published 2023-04-28

Keywords

  • Botnet,
  • Packer,
  • Clustering

Copyright (c) 2023 Ludovic Robin (Author)

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.

How to Cite

Robin, L. . (2023). Incremental Clustering of Malware Packers using features based on Transformed CFG. The Journal on Cybercrime and Digital Investigations, 8(1), A1-A8. https://doi.org/10.18464/cybin.v8i1.43

Download Citation

Abstract

Packer detection is an important topic because most malware is packed and this allows it to avoid detection based on static analysis. Identifying classes of packers is the key to effective detection because it makes it easier to determine from a static analysis whether further analysis is needed or whether a decision is already possible. Thus in this work we propose new features to cluster packers from their unpacking function. This method makes it possible to effectively cluster packers, and is able, by clustering, to identify packer classes used by malware. It is a step towards a larger data clustering allowing to identify custom packers.

PDF

References

  1. “Clamavnet.” https://www.clamav.net/. (Accessed on 12/08/2022).
  2. “horsicq/detect-it-easy: Program for determining types of files for windows, linux and macos..” https://github.com/horsicq/Detect-It-Easy.
  3. “Upx: the ultimate packer for executables - homepage. https://upx.github.io/. (Accessed on 12/07/2022).
  4. “plusvic/yara: The pattern matching swiss knife.” https://github.com/plusvic/yara.
  5. “wolfram77web/app-peid: Peid detects most common packers, cryptors and compilers for pe files..” https://github.com/wolfram77web/app-peid. (Accessed on 12/07/2022).
  6. F. Biondi, M. A. Enescu, T. Given-Wilson, A. Legay, L. Noureddine, and V. Verma, “Effective, efficient, and robust packing detection and classification,” Computers & Security, vol. 85, pp. 436–451, 2019.
  7. M. Saleh, E. P. Ratazzi, and S. Xu, “A control flow graph-based signature for packer identification,” in MILCOM 2017-2017 IEEE Military Communications Conference (MILCOM), pp. 683–688, IEEE, 2017.
  8. L. Noureddine, A. Heuser, C. Puodzius, and O. Zendra, “Se-pac: A self-evolving packer classifier against rapid packers evolution,” in Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy, pp. 281–292, 2021.
  9. “radare2.” https://www.radare.org/n/.
  10. P. Antoine, G. Bonfante, and J. Marion, “Gorille: Efficient and relevant software comparisons,” ERCIM News, vol. 2016, no. 106, 2016.
  11. M. Vijaymeena and K. Kavitha, “A survey on similarity measures in text mining,” Machine Learning and Applications: An International Journal, vol. 3, no. 2, pp. 19–28, 2016.
  12. M. Ester, H.-P. Kriegel, J. Sander, X. Xu, et al., “A density-based algorithm for discovering clusters in large spatial databases with noise.,” in kdd, vol. 96, pp. 226–231, 1996.
  13. G. Bonfante, J. Fernandez, J.-Y. Marion, B. Rouxel, F. Sabatier, and A. Thierry, “Codisasm: Medium scale concatic disassembly of self-modifying binaries with overlapping instructions,” in Proceedings of the 22nd ACMSIGSAC Conference on Computer and Communications Security, pp. 745–756, 2015.
  14. “Malwarebazaar | malware sample exchange. https://bazaar.abuse.ch/. (Accessed on 12/07/2022).
  15. “Zeus/zbot unpacking : analyse d’un packer customisé | connect - editions diamond.” https://connect.ed-diamond.com/MISC/misc-051/zeus-zbot-unpacking-analyse-d-un-packer-customise. (Accessed on 12/09/2022).