{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,14]],"date-time":"2026-10-14T16:52:00Z","timestamp":1791996720151,"version":"4.4.0"},"reference-count":47,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2017,3,16]],"date-time":"2017-03-16T00:00:00Z","timestamp":1489622400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Packing algorithms are broadly used to avoid anti-malware systems, and the proportion of packed malware has been growing rapidly. However, just a few studies have been conducted on detection various types of packing algorithms in a systemic way. Following this understanding, we elaborate a method to classify packing algorithms of a given executable into three categories: single-layer packing, re-packing, or multi-layer packing. We convert entropy values of the executable file loaded into memory into symbolic representations, for which we used SAX (Symbolic Aggregate Approximation). Based on experiments of 2196 programs and 19 packing algorithms, we identify that precision (97.7%), accuracy (97.5%), and recall ( 96.8%) of our method are respectively high to confirm that entropy analysis is applicable in identifying packing algorithms.<\/jats:p>","DOI":"10.3390\/e19030125","type":"journal-article","created":{"date-parts":[[2017,3,16]],"date-time":"2017-03-16T11:24:28Z","timestamp":1489663468000},"page":"125","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":25,"title":["Packer Detection for Multi-Layer Executables Using Entropy Analysis"],"prefix":"10.3390","volume":"19","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6366-0805","authenticated-orcid":false,"given":"Munkhbayar","family":"Bat-Erdene","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering, Korea University, 02841 Seoul, Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Taebeom","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Korea University, 02841 Seoul, Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hyundo","family":"Park","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Korea University, 02841 Seoul, Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Heejo","family":"Lee","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Korea University, 02841 Seoul, Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2017,3,16]]},"reference":[{"key":"ref_1","unstructured":"Choi, H., Zhu, B.B., and Lee, H. (2011, January 15\u201316). Detecting Malicious Web Links and Identifying Their Attack Types. Proceedings of the 2nd USENIX Conference on Web Application Development, Portland, OR, USA."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Bat-Erdene, M., Kim, T., Li, H., and Lee, H. (2013, January 22\u201324). Dynamic classification of packing algorithms for inspecting executables using entropy analysis. Proceedings of the IEEE International Conference on Malicious and Unwanted Software: \u201cThe Americas\u201d (MALWARE), Fajardo, PR, USA.","DOI":"10.1109\/MALWARE.2013.6703681"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"65","DOI":"10.1109\/MSP.2008.126","article-title":"Revealing Packed Malware","volume":"6","author":"Yan","year":"2008","journal-title":"IEEE Secur. Priv."},{"key":"ref_4","unstructured":"Wright, C.S. Packer Analysis Report Debugging and Unpacking the NsPack 3.4 and 3.7 Packer. Available online: https:\/\/www.sans.org\/reading-room\/whitepapers\/malicious\/packer-analysis-report-debugging-unpacking-nspack-34-37-packer-33428."},{"key":"ref_5","unstructured":"Guo, F., Ferrie, P., and Chiueh, T.C. (2008, January 15\u201317). A study of the packer problem and its solutions. Proceedings of the 11th International Symposium on Recent Advances in Intrusion Detection (RAID), Cambridge, MA, USA."},{"key":"ref_6","unstructured":"Yara Rules Project. Available online: https:\/\/github.com\/Yara-Rules\/rules\/."},{"key":"ref_7","unstructured":"GitHub. Available online: https:\/\/github.com\/m-dwyer\/packer-malware."},{"key":"ref_8","first-page":"22","article-title":"Classifying Packed Programs as Malicious Software Detected","volume":"5","author":"Osaghae","year":"2016","journal-title":"Int. J. Inf. Technol. Electr. Eng."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Jacob, G., Comparetti, P.M., Neugschwandtner, M., Kruegel, C., and Vigna, G. (2012, January 26\u201327). A static, packer-agnostic filter to detect similar malware samples. Proceedings of the 9th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), Heraklion, Greece.","DOI":"10.1007\/978-3-642-37300-8_6"},{"key":"ref_10","unstructured":"Brosch, T., and Morgenstern, M. (2006). Runtime Packers: The Hidden Problem, Black Hat."},{"key":"ref_11","unstructured":"ASPack Software. Available online: http:\/\/www.aspack.com\/aspack.html."},{"key":"ref_12","unstructured":"Northfox\u2019s Dungeon MEW Software. Available online: http:\/\/northfox.uw.hu\/index.php?lang=engid=dev."},{"key":"ref_13","unstructured":"ASPack Software. Available online: http:\/\/www.aspack.com\/asprotect32.html."},{"key":"ref_14","unstructured":"NsPack 3.7. Available online: http:\/\/nspack.download-230-13103.programsbase.com\/."},{"key":"ref_15","unstructured":"Oreans Technologies. Available online: http:\/\/www.oreans.com\/themida.php."},{"key":"ref_16","unstructured":"RLPack 1.2. Available online: http:\/\/rlpack.software.informer.com\/1.2\/."},{"key":"ref_17","unstructured":"VMPsoft. Available online: http:\/\/vmpsoft.com\/products\/vmprotect\/."},{"key":"ref_18","unstructured":"Alternate_EXE Packer. Available online: http:\/\/www.alternate-tools.com\/pages\/c_exepacker.php?lang=ENG."},{"key":"ref_19","unstructured":"Al-Anezi, M.M.K. (2016). Generic packing detection using several complexity analysis for accurate malware detection. Int. J. Adv. Comput. Sci. Appl."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Santos, I., Ugarte-Pedrero, X., Sanz, B., Laorden, C., and Bringas, P.G. (2011, January 1\u20132). Collective classification for packed executable identification. Proceedings of the 8th Annual Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference, Perth, Australia.","DOI":"10.1145\/2030376.2030379"},{"key":"ref_21","unstructured":"McAfee The Good, the Bad, and the Unknown. Available online: http:\/\/www.techdata.com\/mcafee\/files\/MCAFEE_wp_appcontrol-good-bad-unknown.pdf."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1193","DOI":"10.1109\/TC.2012.65","article-title":"Malwise\u2014An effective and efficient classification system for packed and polymorphic malware","volume":"62","author":"Cesare","year":"2013","journal-title":"IEEE Trans. Comput."},{"key":"ref_23","unstructured":"Offensive Computing. Available online: http:\/\/www.offensivecomputing.net\/."},{"key":"ref_24","unstructured":"VX Heavens. Available online: http:\/\/vxheaven.org\/."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Ugarte-Pedrero, X., Santos, I., Sanz, B., Laorden, C., and Bringas, P.G. (2012, January 14\u201317). Countering entropy measure attacks on packed software detection. Proceedings of the 2012 IEEE Consumer Communications and Networking Conference (CCNC), Las Vegas, NV, USA.","DOI":"10.1109\/CCNC.2012.6181079"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Shafiq, M.Z., Tabish, S.M., Mirza, F., and Farooq, M. (2009, January 23\u201325). Pe-miner: Mining structural information to detect malicious executables in realtime. Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection (RAID), Saint-Malo, France.","DOI":"10.1007\/978-3-642-04342-0_7"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Liu, L., Ming, J., Wang, Z., Gao, D., and Jia, C. (2009, January 14\u201317). Denial-of-service attacks on host-based generic unpackers. Proceedings of the International Conference on Information and Communications Security (ICICS), Beijing, China.","DOI":"10.1007\/978-3-642-11145-7_19"},{"key":"ref_28","unstructured":"Meijer, B.R. (September, January 30). Rules and algorithms for the design of templates for template matching. Proceedings of the 11th IAPR International Conference on Pattern Recognition, Conference A: Computer Vision and Applications, The Hague, The Netherlands."},{"key":"ref_29","unstructured":"Cesare, S., and Xiang, Y. (2010, January 1). Classification of malware using structured control flow. Proceedings of the Eighth Australasian Symposium on Parallel and Distributed Computing, Brisbane, Australia."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"121","DOI":"10.1023\/A:1009715923555","article-title":"A tutorial on support vector machines for pattern recognition","volume":"2","author":"Burges","year":"1998","journal-title":"Data Min. Knowl. Discov."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Martignoni, L., Christodorescu, M., and Jha, S. (2007, January 10\u201314). Omniunpack: Fast, generic, and safe unpacking of malware. Proceedings of the Computer Security Applications Conference (ACSAC), Miami Beach, FL, USA.","DOI":"10.1109\/ACSAC.2007.15"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Kang, M.G., Poosankam, P., and Yin, H. (2007, January 2). Renovo: A hidden code extractor for packed executables. Proceedings of the ACM Workshop on Recurring Malcode, Alexandria, VA, USA.","DOI":"10.1145\/1314389.1314399"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Jeong, G., Choo, E., Lee, J., Bat-Erdene, M., and Lee, H. (2010, January 19\u201320). Generic unpacking using entropy analysis. Proceedings of the 2010 5th International Conference on Malicious and Unwanted Software (MALWARE), Nancy, France.","DOI":"10.1109\/MALWARE.2010.5665789"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Devi, D., and Nandi, S. (2012, January 17\u201319). Detection of packed malware. Proceedings of the First International Conference on Security of Internet of Things, Kollam, India.","DOI":"10.1145\/2490428.2490431"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"1941","DOI":"10.1016\/j.patrec.2008.06.016","article-title":"Classification of packed executables for accurate computer virus detection","volume":"29","author":"Perdisci","year":"2008","journal-title":"Pattern Recognit. Lett."},{"key":"ref_36","unstructured":"An in-Depth Look Into the Win32 Portable Executable File Format\u2014Part 2. Available online: http:\/\/www.delphibasics.info\/home\/delphibasicsarticles\/anin-depthlookintothewin32portableexecutablefileformat-part2."},{"key":"ref_37","unstructured":"Pietrek, M. Peering Inside the PE: A Tour of the Win32 Portable Executable File Format. Available online: https:\/\/msdn.microsoft.com\/en-us\/library\/ms809762.aspx."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Ugarte-Pedrero, X., Balzarotti, D., Santos, I., and Bringas, P.G. (2015, January 17\u201321). SoK: Deep packer inspection: A longitudinal study of the complexity of run-time packers. Proceedings of the IEEE Symposium on Security and Privacy, San Jose, CA, USA.","DOI":"10.1109\/SP.2015.46"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"40","DOI":"10.1109\/MSP.2007.48","article-title":"Using entropy analysis to find encrypted and packed malware","volume":"5","author":"Lyda","year":"2007","journal-title":"IEEE Secur. Priv."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Sun, L., Versteeg, S., Bozta\u015f, S., and Yann, T. (2010, January 5\u20137). Pattern recognition techniques for the classification of malware packers. Proceedings of the 15th Australasian conference on Information security and privacy, Sydney, Australia.","DOI":"10.1007\/978-3-642-14081-5_23"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Vapnik, V. (1995). The Nature of Statistical Learning Theory, Springer.","DOI":"10.1007\/978-1-4757-2440-0"},{"key":"ref_42","unstructured":"Vapnik, V., and Chervonenkis, A.Y. (1974). Theory of Pattern Recognition: Statistical Problems of Learning, Nauka."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Lin, J., Keogh, E., Lonardi, S., and Chiu, B. (2003, January 13). A symbolic representation of time series, with implications for streaming algorithms. Proceedings of the 8th ACM SIGMOD Workshop on Research Issues in Data Mining and Knowledge Discovery, San Diego, CA, USA.","DOI":"10.1145\/882082.882086"},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"349","DOI":"10.1023\/A:1024988512476","article-title":"On the need for time series data mining benchmarks: A survey and empirical demonstration","volume":"7","author":"Keogh","year":"2003","journal-title":"Data Min. Knowl. Discov."},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"263","DOI":"10.1007\/PL00011669","article-title":"Dimensionality reduction for fast similarity search in large time series databases","volume":"3","author":"Keogh","year":"2001","journal-title":"Knowl. Inf. Syst."},{"key":"ref_46","unstructured":"Yi, B.K., and Faloutsos, C. (2000, January 10\u201314). Fast time sequence indexing for arbitrary Lp norms. Proceedings of the 26th International Conference on Very Large Data Bases (VLDB), Cairo, Egypt."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Bat-Erdene, M., Park, H., Li, H., Lee, H., and Choi, M.S. (2016). Entropy analysis to classify unknown packing algorithms for malware detection. Int. J. Inf. Secur.","DOI":"10.1007\/s10207-016-0330-4"}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/19\/3\/125\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T18:30:37Z","timestamp":1760207437000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/19\/3\/125"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,3,16]]},"references-count":47,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2017,3]]}},"alternative-id":["e19030125"],"URL":"https:\/\/doi.org\/10.3390\/e19030125","relation":{},"ISSN":["1099-4300"],"issn-type":[{"value":"1099-4300","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,3,16]]}}}