{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T08:28:21Z","timestamp":1792744101639,"version":"4.5.0"},"reference-count":128,"publisher":"Association for Computing Machinery (ACM)","issue":"5","license":[{"start":{"date-parts":[[2022,12,3]],"date-time":"2022-12-03T00:00:00Z","timestamp":1670025600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2023,5,31]]},"abstract":"<jats:p>\n                    With the growing sophistication of malware, the need to devise improved malware detection schemes is crucial. The packing of executable files, which is one of the most common techniques for code protection, has been repurposed for code obfuscation by malware authors as a means of evading malware detectors (mainly static analysis-based detectors). This paper provides statistics on the use of packers based on an extensive analysis of 24,000 PE files (both malicious and benign files) for the past 10 years, which allowed us to observe trends in packing use during that time and showed that packing is still widely used in malware. This paper then surveys 23 methods proposed in academic research for the detection and classification of packed\n                    <jats:bold>portable executable (PE)<\/jats:bold>\n                    files and highlights various trends in malware packing. The paper highlights the differences between the methods and their abilities to detect and identify various aspects of packing. A taxonomy is presented, classifying the methods as static, dynamic, and hybrid analysis-based methods. The paper also sheds light on the increasing role of machine learning methods in the development of modern packing detection methods. We analyzed and mapped the different packing methods and identified which of them can be countered by the detection methods surveyed in this paper.\n                  <\/jats:p>","DOI":"10.1145\/3530810","type":"journal-article","created":{"date-parts":[[2022,5,24]],"date-time":"2022-05-24T03:02:27Z","timestamp":1653361347000},"page":"1-45","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":42,"title":["File Packing from the Malware Perspective: Techniques, Analysis Approaches, and Directions for Enhancements"],"prefix":"10.1145","volume":"55","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2773-0030","authenticated-orcid":false,"given":"Trivikram","family":"Muralidharan","sequence":"first","affiliation":[{"name":"Malware Lab, Cyber Security Research Center, Ben-Gurion University of the Negev, Beer-Sheva, Israel and Department of Industrial Engineering and Management, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9976-0525","authenticated-orcid":false,"given":"Aviad","family":"Cohen","sequence":"additional","affiliation":[{"name":"Malware Lab, Cyber Security Research Center, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3102-2726","authenticated-orcid":false,"given":"Noa","family":"Gerson","sequence":"additional","affiliation":[{"name":"Malware Lab, Cyber Security Research Center, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0652-8861","authenticated-orcid":false,"given":"Nir","family":"Nissim","sequence":"additional","affiliation":[{"name":"Malware Lab, Cyber Security Research Center, Ben-Gurion University of the Negev, Beer-Sheva, Israel and Department of Industrial Engineering and Management, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,12,3]]},"reference":[{"key":"e_1_3_2_2_2","first-page":"19","article-title":"Dynamic classification of packing algorithms for inspecting executables using entropy analysis","author":"Bat-Erdene M.","year":"2013","unstructured":"M. Bat-Erdene, T. Kim, H. Li, and H. Lee. 2013. Dynamic classification of packing algorithms for inspecting executables using entropy analysis. Proc. 2013 8th Int. Conf. Malicious Unwanted Softw. The Am. MALWARE 2013. 19\u201326.","journal-title":"Proc. 2013 8th Int. Conf. Malicious Unwanted Softw. The Am. MALWARE 2013"},{"key":"e_1_3_2_3_2","doi-asserted-by":"crossref","unstructured":"M. M. K. Al-Zanei. 2014. Generic packing detection using several complexity analysis for accurate malware detection 5 1 (2014) 7\u201314.","DOI":"10.14569\/IJACSA.2014.050102"},{"key":"e_1_3_2_4_2","first-page":"370","volume-title":"Pattern Recognition Techniques for the Classification of Malware Packers","author":"Sun L.","year":"2010","unstructured":"L. Sun, S. Versteeg, S. Bozta\u015f, and T. Yann. 2010. Pattern Recognition Techniques for the Classification of Malware Packers. Springer, Berlin, 2010, 370\u2013390."},{"key":"e_1_3_2_5_2","unstructured":"D.-I. M. Morgenstern and H. Pilz. Useful and useless statistics about viruses and anti-virus programs."},{"key":"e_1_3_2_6_2","author":"Ferrie Peter","year":"2008","unstructured":"Peter Ferrie, Senior Anti-virus Researcher, and Microsoft Corporation. 2008. Anti-unpacker tricks. Current (2008).","journal-title":"Current"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.3390\/e19030125"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2008.126"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISORC.2010.23"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSA.2008.28"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2008.06.016"},{"key":"e_1_3_2_12_2","unstructured":"PE Format | Microsoft Docs. [Online]. Available: https:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/debug\/pe-format. [Accessed: 04-Feb-2021]."},{"issue":"3","key":"e_1_3_2_13_2","first-page":"476","article-title":"PE file features in detection of packed executables","volume":"4","author":"Devi D.","year":"2012","unstructured":"D. Devi and S. Nandi. 2012. PE file features in detection of packed executables. Entropy 4, 3 (2012), 476\u2013478.","journal-title":"Entropy"},{"key":"e_1_3_2_14_2","unstructured":"M. Sikorski and A. Honig. 2012. Practical malware analysis: The hands-on guide to dissecting malicious software. No Starch Press."},{"key":"e_1_3_2_15_2","doi-asserted-by":"crossref","unstructured":"L. Sun S. Versteeg S. Bozta\u015f and T. Yann. 2010 July. Pattern recognition techniques for the classification of malware packers. In Australasian Conference on Information Security and Privacy . Springer Berlin Heidelberg 370\u2013390.","DOI":"10.1007\/978-3-642-14081-5_23"},{"key":"e_1_3_2_16_2","unstructured":"D. M. Abhi Gupta and Akshi S. Arya. 2018. Hashing Base Ed Encryption N And Anti-Deb Bugger Suppor Rt For Packing Multiple Fi Es Into Sing E Executable (2018) 96\u201399."},{"key":"e_1_3_2_17_2","unstructured":"\u201cI Executable and Linkable Format (ELF).\u201d"},{"issue":"4","key":"e_1_3_2_18_2","first-page":"1","article-title":"ITEE Journal","volume":"4","author":"Muhammad K.","year":"2015","unstructured":"K. Muhammad and H. Zahid. 2015. ITEE Journal. ITEE J. 4, 4 (2015), 1\u20135.","journal-title":"ITEE J"},{"issue":"1","key":"e_1_3_2_19_2","first-page":"10","article-title":"ITEE Journal","volume":"6","author":"Hassnain M.","year":"2017","unstructured":"M. Hassnain and A. Abbas. 2017. ITEE Journal. Int. J. Inf. Technol. Electr. Eng. 6, 1 (2017), 10\u201316.","journal-title":"Int. J. Inf. Technol. Electr. Eng"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-016-0330-4"},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2018.02.040"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2007.48"},{"key":"e_1_3_2_23_2","first-page":"102","article-title":"A static, packer-agnostic filter to detect similar malware samples","author":"Jacob G.","year":"2013","unstructured":"G. Jacob, P. M. Comparetti, M. Neugschwandtner, C. Kruegel, and G. Vigna. 2013. A static, packer-agnostic filter to detect similar malware samples. In Proceedings of the 9th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment. Springer-Verlag, 2013, 102\u2013122.","journal-title":"Proceedings of the 9th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment"},{"key":"e_1_3_2_24_2","doi-asserted-by":"crossref","unstructured":"J. Zhang K. Zhang Z. Qin H. Yin and Q. Wu. 2018. Sensitive system calls based packed malware variants detection using principal component initialized multilayers neural networks. 1\u201313.","DOI":"10.1186\/s42400-018-0010-y"},{"key":"e_1_3_2_25_2","unstructured":"Entropy and the distinctive signs of packed PE files. | NTinfo. [Online]. Available: http:\/\/n10info.blogspot.com\/2014\/06\/entropy-and-distinctive-signs-of-packed.html. [Accessed: 04-Feb-2021]."},{"key":"e_1_3_2_26_2","doi-asserted-by":"crossref","unstructured":"I. J. Good T. N. Gover and G. J. Mitchell. 1970. Exact distributions for X 2 and for the likelihood-ratio statistic for the equiprobable multinomial distribution. 1970.","DOI":"10.2307\/2004863"},{"key":"e_1_3_2_27_2","first-page":"395","article-title":"Towards paving the way for large-scale windows malware analysis","author":"Cheng B.","year":"2018","unstructured":"B. Cheng et al. 2018. Towards paving the way for large-scale windows malware analysis. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security - CCS \u201918. 395\u2013411.","journal-title":"Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security - CCS \u201918"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.46"},{"key":"e_1_3_2_29_2","doi-asserted-by":"crossref","unstructured":"G. Bonfante et al. 2015. CoDisasm: Medium scale concatic disassembly of self-modifying binaries with overlapping instructions. 2015.","DOI":"10.1145\/2810103.2813627"},{"key":"e_1_3_2_30_2","unstructured":"D. Bueno K. J. Compton K. A. Sakallah and M. Bailey. Detecting traditional packers decisively."},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2012.65"},{"key":"e_1_3_2_32_2","doi-asserted-by":"crossref","first-page":"307","DOI":"10.1109\/ICEDIF.2015.7280213","article-title":"A token strengthened encryption packer to prevent reverse engineering PE files","author":"Li Ang","year":"2015","unstructured":"Ang Li, Yue Zhang, Junxing Zhang, and Gang Zhu. 2015. A token strengthened encryption packer to prevent reverse engineering PE files. In 2015 International Conference on Estimation, Detection and Information Fusion (ICEDIF'15). 307\u2013312.","journal-title":"2015 International Conference on Estimation, Detection and Information Fusion (ICEDIF'15)"},{"key":"e_1_3_2_33_2","unstructured":"L. Bilge A. Lanzi and D. Balzarotti. Thwarting real-time dynamic unpacking."},{"key":"e_1_3_2_34_2","unstructured":"J. K\u0159oustek P. Matula D. Kol\u00e1\u0159 and M. Zavoral. Advanced preprocessing of binary executable files and its usage in retargetable decompilation."},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2013.6671321"},{"key":"e_1_3_2_36_2","volume-title":"Linkers and Loaders","author":"Levine J. R.","year":"2000","unstructured":"J. R. Levine. 2000. Linkers and Loaders. Morgan Kaufmann."},{"key":"e_1_3_2_37_2","first-page":"161","article-title":"Understanding Linux malware","author":"Cozzi E.","year":"2018","unstructured":"E. Cozzi, M. Graziano, Y. Fratantonio, and D. Balzarotti. 2018. Understanding Linux malware. Proc. - IEEE Symp. Secur. Priv. 2018-May, 161\u2013175.","journal-title":"Proc. - IEEE Symp. Secur. Priv"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1145\/2522968.2522972"},{"key":"e_1_3_2_39_2","unstructured":"UPX: the Ultimate Packer for eXecutables - Homepage. [Online]. Available: https:\/\/upx.github.io\/. [Accessed: 10-Feb-2021]."},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2018.10.011"},{"key":"e_1_3_2_41_2","unstructured":"Manual Unpacking of UPX Packed Binary File - www.SecurityXploded.com. [Online]. Available: https:\/\/securityxploded.com\/unpackingupx.php. [Accessed: 10-Feb-2021]."},{"key":"e_1_3_2_42_2","unstructured":"Unpacking Reversing Patching. [Online]. Available: https:\/\/resources.infosecinstitute.com\/unpacking-reversing-patching\/#gref. [Accessed: 11-Feb-2021]."},{"key":"e_1_3_2_43_2","unstructured":"Oreans Technology: Software Security Defined. [Online]. Available: https:\/\/www.oreans.com\/themida.php. [Accessed: 11-Feb-2021]."},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2009.24"},{"key":"e_1_3_2_45_2","volume-title":"Classifying packed programs as malicious software detected","author":"Osaghae E. O.","year":"2016","unstructured":"E. O. Osaghae. 2016. Classifying packed programs as malicious software detected 2016."},{"key":"e_1_3_2_46_2","volume-title":"Pandora's Bochs: Automatic Unpacking of Malware","author":"Bohne L.","year":"2009","unstructured":"L. Bohne. 2009. Pandora's Bochs: Automatic Unpacking of Malware 121, 2009."},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-87403-4_6"},{"key":"e_1_3_2_48_2","first-page":"1","article-title":"A unpacking and reconstruction system-AGUnpacker","author":"Yu S.-C.","year":"2009","unstructured":"S.-C. Yu and Y.-C. Li. 2009. A unpacking and reconstruction system-AGUnpacker. In 2009 International Symposium on Computer Network and Multimedia Technology. 1\u20134.","journal-title":"2009 International Symposium on Computer Network and Multimedia Technology"},{"key":"e_1_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2007.71"},{"key":"e_1_3_2_50_2","first-page":"1","article-title":"Anti-unpacker tricks","author":"Ferrie P.","year":"2008","unstructured":"P. Ferrie, S. A. Researcher, and M. Corporation. 2008. Anti-unpacker tricks. Current. 1\u201325.","journal-title":"Current"},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-017-0291-9"},{"key":"e_1_3_2_52_2","unstructured":"E. Carrera and G. Erd\u00e9lyi. 2004. Digital genome mapping. 2004."},{"key":"e_1_3_2_53_2","doi-asserted-by":"crossref","unstructured":"X. Hu T.-C. Chiueh and K. G. Shin. 2009. Large-Scale Malware Indexing Using Function-Call Graphs * \u2020 . 2009.","DOI":"10.1145\/1653662.1653736"},{"key":"e_1_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.1109\/AMS.2007.31"},{"key":"e_1_3_2_55_2","unstructured":"A. Walenstein M. Venable M. Hayes C. Thompson and A. Lakhotia. Exploiting similarity between variants to defeat malware \u201cVilo\u201d method for comparing and searching binary programs."},{"key":"e_1_3_2_56_2","unstructured":"W. Fleshman E. Raff R. Zak M. Mclean and C. Nicholas. Static malware detection & subterfuge: Quantifying the robustness of machine learning and current anti-virus."},{"key":"e_1_3_2_57_2","first-page":"41","article-title":"N-gram-based detection of new malicious code","volume":"2","author":"Abou-Assaleh T.","year":"2004","unstructured":"T. Abou-Assaleh, N. Cercone, V. Keselj, and R. Sweidan. 2004. N-gram-based detection of new malicious code. Proc. 28th Annu. Int. Comput. Softw. Appl. Conf. 2004. COMPSAC 2004 2 (2004), 41\u201342.","journal-title":"Proc. 28th Annu. Int. Comput. Softw. Appl. Conf. 2004. COMPSAC 2004"},{"key":"e_1_3_2_58_2","unstructured":"G. Wicherski. 2009. peHash: A novel approach to fast malware clustering. 2nd USENIX Work. Large-Scale Exploit. Emergent Threat. 2009."},{"key":"e_1_3_2_59_2","doi-asserted-by":"publisher","DOI":"10.5244\/C.22.50"},{"key":"e_1_3_2_60_2","first-page":"386","article-title":"Binary function clustering using semantic hashes","volume":"1","author":"Jin W.","year":"2012","unstructured":"W. Jin et al. 2012. Binary function clustering using semantic hashes. In Proceedings - 2012 11th International Conference on Machine Learning and Applications, ICMLA'2012, 1, 386\u2013391.","journal-title":"Proceedings - 2012 11th International Conference on Machine Learning and Applications, ICMLA'2012"},{"key":"e_1_3_2_61_2","first-page":"182","article-title":"Scalable semantics-based detection of similar Android applications","author":"Crussell J.","year":"2013","unstructured":"J. Crussell, C. Gibler, and H. Chen. 2013. Scalable semantics-based detection of similar Android applications. In Esorics 2013, 182\u2013199.","journal-title":"Esorics"},{"key":"e_1_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.1007\/s12559-014-9253-4"},{"key":"e_1_3_2_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623342"},{"key":"e_1_3_2_64_2","first-page":"97","article-title":"Locality-sensitive hashing optimizations for fast malware clustering","author":"Oprisa C.","year":"2014","unstructured":"C. Oprisa, M. Checiches, and A. Nandrean. 2014. Locality-sensitive hashing optimizations for fast malware clustering. In Proceedings - 2014 IEEE 10th International Conference on Intelligent Computer Communication and Processing, ICCP'2014. 97\u2013104.","journal-title":"Proceedings - 2014 IEEE 10th International Conference on Intelligent Computer Communication and Processing, ICCP'2014"},{"key":"e_1_3_2_65_2","unstructured":"Statistical Mechanics \u2013 R. K. Pathria Paul D. Beale - Google \u05e1\u05e4\u05e8\u05d9\u05dd.\u201d [Online]. Available: https:\/\/books.google.co.il\/books?id=KdbJJAXQ-RsC&printsec=frontcover&redir_esc=y&hl=iw#v=onepage&q&f=false. [Accessed: 11-Feb-2021]."},{"key":"e_1_3_2_66_2","doi-asserted-by":"publisher","DOI":"10.1145\/2030376.2030379"},{"key":"e_1_3_2_67_2","unstructured":"C. Kolbitsch P. M. Comparetti C. Kruegel E. Kirda X. Zhou and X. Wang. Effective and efficient malware detection at the end host."},{"key":"e_1_3_2_68_2","doi-asserted-by":"crossref","unstructured":"Z. Tzermias G. Sykiotakis M. Polychronakis and E. P. Markatos. 2011. Combining Static and Dynamic Analysis for the Detection of Malicious Documents . 2011.","DOI":"10.1145\/1972551.1972555"},{"key":"e_1_3_2_69_2","doi-asserted-by":"crossref","unstructured":"D. Maiorca I. Corona and G. Giacinto. 2013. Looking at the Bag is not Enough to Find the Bomb: An Evasion of Structural Methods for Malicious PDF Files Detection . 2013.","DOI":"10.1145\/2484313.2484327"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2012.6297926"},{"key":"e_1_3_2_71_2","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2013.166"},{"key":"e_1_3_2_72_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2006.38"},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2018.02.039"},{"key":"e_1_3_2_74_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2018.04.033"},{"key":"e_1_3_2_75_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2014.02.053"},{"key":"e_1_3_2_76_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10044-012-0296-4"},{"key":"e_1_3_2_77_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2016.07.010"},{"key":"e_1_3_2_78_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.10.014"},{"key":"e_1_3_2_79_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2016.2631905"},{"key":"e_1_3_2_80_2","doi-asserted-by":"publisher","DOI":"10.1186\/s13388-016-0026-3"},{"key":"e_1_3_2_81_2","first-page":"760","article-title":"Boosting the detection of malicious documents using designated active learning methods","author":"Nissim N.","year":"2016","unstructured":"N. Nissim, A. Cohen, and Y. Elovici. 2016. Boosting the detection of malicious documents using designated active learning methods. Proc. - 2015 IEEE 14th Int. Conf. Mach. Learn. Appl. ICMLA 2015. 760\u2013765.","journal-title":"Proc. - 2015 IEEE 14th Int. Conf. Mach. Learn. Appl. ICMLA 2015"},{"key":"e_1_3_2_82_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2018.05.031"},{"key":"e_1_3_2_83_2","first-page":"34","article-title":"A fast randomness test that preserves local detail","author":"Ebringer T.","year":"2008","unstructured":"T. Ebringer, L. Sun, and S. Boztas. 2008. A fast randomness test that preserves local detail. Virus Bull. (2008), 34\u201342.","journal-title":"Virus Bull. (2008)"},{"key":"e_1_3_2_84_2","unstructured":"\u201cPE iDentifier (PEiD) 0.95 \/Binary Analysis\/Editing\/Downloads - Tuts 4 You.\u201d [Online]. Available: https:\/\/tuts4you.com\/e107_plugins\/download\/download.php?view.398. [Accessed: 11-Feb-2021]."},{"key":"e_1_3_2_85_2","doi-asserted-by":"publisher","DOI":"10.1145\/1314389.1314399"},{"key":"e_1_3_2_86_2","unstructured":"\u201cExeinfo PE 0.0.5.1 - Download.\u201d [Online]. Available: https:\/\/exeinfo-pe.en.uptodown.com\/windows. [Accessed: 11-Feb-2021]."},{"key":"e_1_3_2_87_2","unstructured":"\u201cExeinfo PE by A.S.L - packer - compression detector and data detector.\u201d [Online]. Available: http:\/\/exeinfo.atwebpages.com\/. [Accessed: 11-Feb-2021]."},{"key":"e_1_3_2_88_2","unstructured":"Google Code Archive - Long-term storage for Google Code Project Hosting. [Online]. Available: https:\/\/code.google.com\/archive\/p\/fuu\/. [Accessed: 21-Feb-2021]."},{"key":"e_1_3_2_89_2","first-page":"2961","article-title":"Temporal probabilistic profiles for sepsis prediction in the ICU","author":"Sheetrit E.","year":"1983","unstructured":"E. Sheetrit, N. Nissim, D. Klimov, and Y. Shahar. 1983. Temporal probabilistic profiles for sepsis prediction in the ICU. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining - KDD\u201919. 2961\u20132969.","journal-title":"Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining - KDD\u201919"},{"key":"e_1_3_2_90_2","doi-asserted-by":"crossref","unstructured":"J. F. Allen. 1983. Maintaining knowledge about temporal intervals. 1983.","DOI":"10.1145\/182.358434"},{"key":"e_1_3_2_91_2","first-page":"316","article-title":"A general language model for information retrieval","author":"Song F.","year":"1999","unstructured":"F. Song and W. B. Croft. 1999. A general language model for information retrieval. In Proceedings of the Eighth International Conference on Information and Knowledge Management. 316\u2013321.","journal-title":"Proceedings of the Eighth International Conference on Information and Knowledge Management"},{"key":"e_1_3_2_92_2","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177729694"},{"key":"e_1_3_2_93_2","unstructured":"Which are the Linux Executable Files and How do We Create Them? [Online]. Available: https:\/\/www.webhostinghero.com\/blog\/which-are-the-linux-executable-files-and-how-do-we-create-them\/. [Accessed: 11-Feb-2021]."},{"key":"e_1_3_2_94_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-015-0249-8"},{"key":"e_1_3_2_95_2","article-title":"Efficient SVM based packer identification with binary diffing measures","author":"Kim Yeongcheol","year":"2019","unstructured":"Yeongcheol Kim, Joon Young Paik, Seokwoo Choi, and Eun Sun Cho. 2019. Efficient SVM based packer identification with binary diffing measures. In Proceedings - International Computer Software and Applications Conference. DOI:https:\/\/doi.org\/10.1109\/COMPSAC.2019.00117","journal-title":"Proceedings - International Computer Software and Applications Conference"},{"key":"e_1_3_2_96_2","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.5082"},{"key":"e_1_3_2_97_2","article-title":"Detection of metamorphic malware packers using multilayered LSTM networks","author":"Bergenholtz Erik","year":"2020","unstructured":"Erik Bergenholtz, Emiliano Casalicchio, Dragos Ilie, and Andrew Moss. 2020. Detection of metamorphic malware packers using multilayered LSTM networks. In Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). DOI:https:\/\/doi.org\/10.1007\/978-3-030-61078-4_3","journal-title":"Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)"},{"key":"e_1_3_2_98_2","article-title":"A control flow graph-based signature for packer identification","author":"Saleh Moustafa","year":"2017","unstructured":"Moustafa Saleh, E. Paul Ratazzi, and Shouhuai Xu. 2017. A control flow graph-based signature for packer identification. In Proceedings - IEEE Military Communications Conference MILCOM. DOI:https:\/\/doi.org\/10.1109\/MILCOM.2017.8170793","journal-title":"Proceedings - IEEE Military Communications Conference MILCOM"},{"key":"e_1_3_2_99_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-018-0323-0"},{"key":"e_1_3_2_100_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.05.007"},{"key":"e_1_3_2_101_2","doi-asserted-by":"publisher","DOI":"10.1587\/transinf.2017EDP7424"},{"key":"e_1_3_2_102_2","article-title":"Packed malware variants detection using deep belief networks","author":"Zhang Zhigang","year":"2020","unstructured":"Zhigang Zhang, Chaowen Chang, Peisheng Han, and Hongtao Zhang. 2020. Packed malware variants detection using deep belief networks. MATEC Web Conf. (2020). DOI:https:\/\/doi.org\/10.1051\/matecconf\/202030902002","journal-title":"MATEC Web Conf"},{"key":"e_1_3_2_103_2","article-title":"Classifying packed malware represented as control flow graphs using deep graph convolutional neural network","author":"Hua Yakang","year":"2020","unstructured":"Yakang Hua, Yuanzheng Du, and Dongzhi He. 2020. Classifying packed malware represented as control flow graphs using deep graph convolutional neural network. In Proceedings - 2020 International Conference on Computer Engineering and Application ICCEA'2020. DOI:https:\/\/doi.org\/10.1109\/ICCEA50009.2020.00062","journal-title":"Proceedings - 2020 International Conference on Computer Engineering and Application ICCEA'2020"},{"key":"e_1_3_2_104_2","article-title":"Malware analysis of imaged binary samples by convolutional neural network with attention mechanism","author":"Yakura Hiromu","year":"2018","unstructured":"Hiromu Yakura, Shinnosuke Shinozaki, Reon Nishimura, Yoshihiro Oyama, and Jun Sakuma. 2018. Malware analysis of imaged binary samples by convolutional neural network with attention mechanism. In CODASPY 2018 - Proceedings of the 8th ACM Conference on Data and Application Security and Privacy. DOI:https:\/\/doi.org\/10.1145\/3176258.3176335","journal-title":"CODASPY 2018 - Proceedings of the 8th ACM Conference on Data and Application Security and Privacy"},{"key":"e_1_3_2_105_2","article-title":"Attention is all you need","author":"Vaswani Ashish","year":"2017","unstructured":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, \u0141ukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In Advances in Neural Information Processing Systems.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_106_2","unstructured":"Obfuscated Files or Information: Software Packing | MITRE. Retrieved February 21 2021 from https:\/\/attack.mitre.org\/techniques\/T1027\/002\/."},{"key":"e_1_3_2_107_2","unstructured":"The WildList Organization International. Retrieved February 25 2021 from http:\/\/www.wildlist.org\/."},{"key":"e_1_3_2_108_2","unstructured":"Five ways Android malware is becoming more resilient | Broadcom. Retrieved February 21 2021 from https:\/\/www.symantec.com\/connect\/blogs\/five-ways-android-malware-becoming-more-resilient."},{"key":"e_1_3_2_109_2","unstructured":"Executable compression - Wikipedia. Retrieved February 21 2021 from https:\/\/en.wikipedia.org\/wiki\/Executable_compression."},{"key":"e_1_3_2_110_2","unstructured":"ImpREC - aldeid. Retrieved February 25 2021 from https:\/\/www.aldeid.com\/wiki\/ImpREC."},{"key":"e_1_3_2_111_2","unstructured":"LordPE - aldeid. Retrieved February 25 2021 from https:\/\/www.aldeid.com\/wiki\/LordPE."},{"key":"e_1_3_2_112_2","unstructured":"Cuckoo Sandbox - Automated Malware Analysis. Retrieved February 21 2021 from https:\/\/cuckoosandbox.org\/."},{"key":"e_1_3_2_113_2","unstructured":"The Sandbox | Understanding CyberForensics. Retrieved February 25 2021 from https:\/\/cwsandbox.org\/."},{"key":"e_1_3_2_114_2","unstructured":"Automated Malware Analysis Tool | Falcon Sandbox | CrowdStrike. Retrieved February 21 2021 from https:\/\/www.crowdstrike.com\/endpoint-security-products\/falcon-sandbox-malware-analysis\/."},{"key":"e_1_3_2_115_2","unstructured":"Free Automated Malware Analysis Service - powered by Falcon Sandbox. Retrieved February 21 2021 from https:\/\/www.hybrid-analysis.com\/."},{"key":"e_1_3_2_116_2","unstructured":"unicorn\/sample_arm.c at master \u00b7 unicorn-engine\/unicorn. Retrieved February 21 2021 from https:\/\/github.com\/unicorn-engine\/unicorn\/blob\/master\/samples\/sample_arm.c."},{"key":"e_1_3_2_117_2","doi-asserted-by":"crossref","unstructured":"Hojjat Aghakhani Fabio Gritti Francesco Mecca Martina Lindorfer Stefano Ortolani Davide Balzarotti Giovanni Vigna and Christopher Kruegel. 2020. When malware is packin\u2019 heat; Limits of machine learning classifiers based on static analysis features. DOI:https:\/\/doi.org\/10.14722\/ndss.2020.24310","DOI":"10.14722\/ndss.2020.24310"},{"key":"e_1_3_2_118_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2008.126"},{"key":"e_1_3_2_119_2","doi-asserted-by":"publisher","DOI":"10.1145\/45072.45074"},{"key":"e_1_3_2_120_2","doi-asserted-by":"publisher","DOI":"10.1109\/JRPROC.1952.273898"},{"key":"e_1_3_2_121_2","unstructured":"Threat Actors Use Delphi Packer to Shield Binaries From Malware Classification. Retrieved November 11 2021 from https:\/\/securityintelligence.com\/news\/threat-actors-use-delphi-packer-to-shield-binaries-from-malware-classification\/."},{"key":"e_1_3_2_122_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2933197"},{"key":"e_1_3_2_123_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2969022"},{"key":"e_1_3_2_124_2","doi-asserted-by":"publisher","DOI":"10.1109\/JISIC.2014.23"},{"key":"e_1_3_2_125_2","doi-asserted-by":"publisher","DOI":"10.1109\/THS.2018.8574202"},{"key":"e_1_3_2_126_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2019.00076"},{"key":"e_1_3_2_127_2","doi-asserted-by":"publisher","DOI":"10.1109\/Trustcom\/BigDataSE\/ICESS.2017.240"},{"key":"e_1_3_2_128_2","unstructured":"GitHub - NtQuery\/Scylla: Imports Reconstructor. Retrieved March 7 2022 from https:\/\/github.com\/NtQuery\/Scylla."},{"key":"e_1_3_2_129_2","doi-asserted-by":"crossref","unstructured":"Alessandro Mantovani Simone Aonzo Xabier Ugarte-Pedrero Alessio Merlo and Davide Balzarotti. Prevalence and impact of low-entropy packing schemes in the malware ecosystem. DOI:https:\/\/doi.org\/10.14722\/ndss.2020.24297","DOI":"10.14722\/ndss.2020.24297"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3530810","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3530810","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T14:09:25Z","timestamp":1750169365000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3530810"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,3]]},"references-count":128,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2023,5,31]]}},"alternative-id":["10.1145\/3530810"],"URL":"https:\/\/doi.org\/10.1145\/3530810","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,3]]},"assertion":[{"value":"2021-03-22","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-04-06","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-12-03","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}