TL;DR
PackHero introduces a scalable, graph-based static method for packer identification that outperforms existing tools in accuracy, scalability, and handling virtualization-based packers, with minimal training data.
Contribution
The paper presents PackHero, a novel static approach using Graph Matching Networks and clustering to improve packer identification efficiency and scalability.
Findings
Achieves 93.7% F1-score with 10 samples per packer
Reaches 98.3% F1-score with 100 samples
Outperforms signature-based tools on virtualization packers
Abstract
Anti-analysis techniques, particularly packing, challenge malware analysts, making packer identification fundamental. Existing packer identifiers have significant limitations: signature-based methods lack flexibility and struggle against dynamic evasion, while Machine Learning approaches require extensive training data, limiting scalability and adaptability. Consequently, achieving accurate and adaptable packer identification remains an open problem. This paper presents PackHero, a scalable and efficient methodology for identifying packers using a novel static approach. PackHero employs a Graph Matching Network and clustering to match and group Call Graphs from programs packed with known packers. We evaluate our approach on a public dataset of malware and benign samples packed with various packers, demonstrating its effectiveness and scalability across varying sample sizes. PackHero…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
