This paper studies the new approach of applying a statistical approach to tackle this problem. We propose a new weight for extracting what obfuscation techniques might be more favourable in packers. We call it obfuscation technique frequency-inverse packer frequency. | Journal of Science and Technology 54 (3A) (2016) 129-139 A STATISTICAL APPROACH FOR PACKER IDENTIFICATION Nguyen Minh Hai, Quan Thanh Tho* Faculty of Computer Science and Engineering, HCM City University of Technology 268 Ly Thuong Kiet Street, Ward 14, District 10, Ho Chi Minh city, Vietnam * Email: qttho@ Received: 15 June 2016; Accepted for publication: 28 July 2016 ABSTRACT Most of modern malware are packed by packers which automatically generate a lot of obfuscation techniques to defeat the anti-virus software. To identify packer, most of industry approaches still adopt the well-known technique of signature matching which can be easily evaded. This paper studies the new approach of applying a statistical approach to tackle this problem. We propose a new weight for extracting what obfuscation techniques might be more favourable in packers. We call it obfuscation technique frequency-inverse packer frequency ( ). As the term implies, calculates values for each obfuscation techniques in a packer through an inverse proportion of the frequency of the obfuscation technique in a particular packer to the percentage of packers the obfuscation technique appears in. Obfuscation techniques with high value show a strong relationship with the packer they appear in. Based on this weight, packer is represented by a vector of . Then the used packer is identified by measuring the similarity between vectors of packer and targeted file. For checking the accuracy of our approach, we have performed the experiments of identifying packer on 200 real-world malware for comparing between our approach with the binary signature technique adopted in CFF Explorer. The result shows that our technique produces the better detection. Keywords: concolic testing, packer, malware analysis, tf-idf, obfuscation techniques. 1. INTRODUCTION Modern popular malwares are packed or obfuscated by packer to generate new invariants. According to [1, 2], 80 % of malware is packed by many .
