Packed PE File Detection for Malware Forensics
Packed PE File Detection for Malware Forensics
复制标题
用于恶意软件取证的打包 PE 文件检测
DOI：
10.1109/csa.2009.5404211
复制
发表时间：
2009
期刊：
影响因子：
--
通讯作者：
Sangjin Lee
中科院分区：
文献类型：
--
作者：
Seung;Keun;Sangjin Lee
在恶意软件事故调查中，最重要的是对恶意代码的检测。基于签名的杀毒软件在大多数事故中都得到了应用。恶意软件可以通过打包或加密的方式很容易地避开基于签名的检测。因此，打包文件检测也很重要。检测方法分为基于签名的检测和基于熵的检测。基于签名的检测不能检测到新的包装。基于熵的检测存在假阳性的问题。我们提出了利用入口点截面的熵统计和压缩文件基本特征的“写”属性的检测方法。然后给出了包装检测工具，并对其性能进行了评价。
In malware accident investigation, the most important thing is detection of malicious code. Signature based anti-virus softwares have been used in most of the accident. Malware can easily avoid signature based detection by using packing or encryption method. Because of this, packed file detection is also important. Detection methods can be divided into signature based detection and entropy based detection. Signature based detection can not detect new packing. And entropy based detection has a problem with false positive. We provides detection method using entropy statistics of entry point section and 'write' properties of essential characteristic of packed file. And then, we show packing detection tool and evaluate its performance.