Structural Feature Based Anomaly Detection for Packed Executable Identification

  • Xabier Ugarte-Pedrero
  • Igor Santos
  • Pablo G. Bringas
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6694)


Malware is any software with malicious intentions. Commercial anti-malware software relies on signature databases. This approach has proven to be effective when the threats are already known. However, malware writers employ software encryption tools and code obfuscation techniques to hide the actual behaviour of their malicious programs. One of these techniques is executable packing, which consists of encrypting the real code of the executable so that it is decrypted in its execution. Commercial solutions to this problem try to identify the packer and then apply the corresponding unpacking routine for each packing algorithm. Nevertheless, this approach fails to detect new and custom packers. Therefore, generic unpacking methods have been proposed which execute the binary in a contained environment and gather its actual code. However, these approaches are very time-consuming and, therefore, a filter step is required that identifies whether an executable is packed or not. In this paper, we present the first packed executable detector based on anomaly detection. This approach represents not packed executables as feature vectors of structural information and heuristic values. Thereby, an executable is classified as packed or not packed by measuring its deviation to the representation of normality (not packed executables). We show that this method achieves high accuracy rates detecting packed executables while maintaining a low false positive rate.


malware anomaly detection computer security packer 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Kaspersky: Kaspersky security bulletin: Statistics (2008),
  2. 2.
    McAfee Labs: Mcafee whitepaper: The good, the bad, and the unknown (2011),
  3. 3.
    PEiD: PEiD webpage (2010),
  4. 4.
    Faster Universal Unpacker (1999),
  5. 5.
    Morgenstern, M., Pilz, H.: Useful and useless statistics about viruses and anti-virus programs. In: Proceedings of the CARO Workshop (2010),
  6. 6.
    Babar, K., Khalid, F.: Generic unpacking techniques. In: Proceedings of the 2nd International Conference on Computer, Control and Communication (IC4), pp. 1–6. IEEE, Los Alamitos (2009)Google Scholar
  7. 7.
    Data Rescue: Universal PE Unpacker plug-in,
  8. 8.
    Stewart, J.: Ollybone: Semi-automatic unpacking on ia-32. In: Proceedings of the 14th DEF CON Hacking Conference (2006)Google Scholar
  9. 9.
    Royal, P., Halpin, M., Dagon, D., Edmonds, R., Lee, W.: Polyunpack: Automating the hidden-code extraction of unpack-executing malware. In: Proceedings of the 2006 Annual Computer Security Applications Conference (ACSAC), pp. 289–300 (2006)Google Scholar
  10. 10.
    Kang, M., Poosankam, P., Yin, H.: Renovo: A hidden code extractor for packed executables. In: Proceedings of the 2007 ACM Workshop on Recurring Malcode, pp. 46–53. ACM, New York (2007)CrossRefGoogle Scholar
  11. 11.
    Martignoni, L., Christodorescu, M., Jha, S.: Omniunpack: Fast, generic, and safe unpacking of malware. In: Proceedings of the 2007 Annual Computer Security Applications Conference (ACSAC), pp. 431–441 (2007)Google Scholar
  12. 12.
    Yegneswaran, V., Saidi, H., Porras, P., Sharif, M., Mark, W.: Eureka: A framework for enabling static analysis on malware. Technical report, Technical Report SRI-CSL-08-01 (2008)Google Scholar
  13. 13.
    Danielescu, A.: Anti-debugging and anti-emulation techniques. CodeBreakers Journal 5(1) (2008),
  14. 14.
    Cesare, S.: Linux anti-debugging techniques, fooling the debugger (1999),
  15. 15.
    Julus, L.: Anti-debugging in WIN32 (1999),
  16. 16.
    Farooq, M.: PE-Miner: Mining Structural Information to Detect Malicious Executables in Realtime. In: Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection (RAID), pp. 121–141. Springer, Heidelberg (2009)Google Scholar
  17. 17.
    Shafiq, M., Tabish, S., Farooq, M.: PE-Probe: Leveraging Packer Detection and Structural Information to Detect Malicious Portable Executables. In: Proceedings of the Virus Bulletin Conference (VB), pp. 29–33 (2009)Google Scholar
  18. 18.
    Perdisci, R., Lanzi, A., Lee, W.: McBoost: Boosting scalability in malware collection and analysis using statistical classification of executables. In: Proceedings of the 2008 Annual Computer Security Applications Conference (ACSAC), pp. 301–310 (2008)Google Scholar
  19. 19.
    Kent, J.: Information gain and a general measure of correlation. Biometrika 70(1), 163–173 (1983)MathSciNetCrossRefzbMATHGoogle Scholar
  20. 20.
    Tata, S., Patel, J.: Estimating the Selectivity of tf-idf based Cosine Similarity Predicates. SIGMOD Record 36(2), 75–80 (2007)CrossRefGoogle Scholar
  21. 21.

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Xabier Ugarte-Pedrero
    • 1
  • Igor Santos
    • 1
  • Pablo G. Bringas
    • 1
  1. 1.S3Lab, DeustoTech - Computing, Deusto Institute of TechnologyUniversity of DeustoBilbaoSpain

Personalised recommendations