Packer Classification Using PE Section Features and DNN
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional packer detection methods are ineffective in identifying new and variant packers, as they rely on signature patterns that can be easily modified, making it difficult to classify files using static analysis and detect malicious code.
Innovation Solution
A packer classification apparatus and method using PE section information that employs a Deep Neural Network (DNN) to extract features from file sections and classify packers, involving a collection classification module, token hash module, and type classification module to generate a learning model and classify files by packer type.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based packer detection methods are used, then known packers can be detected, but new and variant packers cannot be detected
Solution Approach 1:
The patent transforms the detection approach from signature-based pattern matching to feature-based representation using PE section information. By changing the detection parameters from fixed signatures to dynamic feature vectors derived from section names, entropy values, and section characteristics, the system can adapt to new and variant packers while maintaining detection accuracy for known packers.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a machine learning-based classification system. Instead of manually defined signatures, the system uses Deep Neural Networks to automatically learn and generalize packer patterns from training data, enabling detection of both known and unknown packer variants through feature-based classification.
2Difficulty of detecting and measuring
If static analysis is applied to packed files, then code interpretation becomes difficult, but section patterns can be extracted for classification
Solution Approach 1:
The patent extracts specific section information from packed files without requiring full code interpretation. By taking out and analyzing section names, section counts, entropy values, and other metadata features, the system bypasses the difficulty of interpreting packed code while still gaining sufficient information for accurate packer classification and detection.
3Adaptability or versatility
If Deep Neural Network is used for packer classification, then new/variant packers can be detected, but system complexity increases
Solution Approach 1:
The patent segments the packer detection system into distinct functional modules: feature extraction module that processes PE section information, feature hashing module that transforms features into standardized representations, and classification module that performs packing type identification. This segmentation manages system complexity by organizing the DNN-based classification into manageable, modular components with clear interfaces.
Solution Approach 2:
The patent introduces feature hashing as an intermediary layer between raw PE section features and the Deep Neural Network classifier. This intermediary transforms variable-length feature strings into fixed-dimensional hash vectors, simplifying the input requirements for the DNN and reducing overall system complexity while maintaining the ability to detect new and variant packers.
Data Source
AI summary
A packer classification apparatus extracts features based on a section that holds packer information from files and classifies packers using a Deep Neural Network(DNN) for detection of new/variant packers. A packer classification apparatus according to an embodiment uses PE section information. packer classification apparatus includes a collection classification module collecting a data set and classifying data by packer type to prepare for a model learning, a token hash module tokenizing a character string obtained after extracting labels and section names of each data and combining the section names, and obtaining a certain standard output value using Feature Hashing, and a type classification module generating a learning model after learning the data set with a Deep Neural Network(DNN) algorithm using extracted features, and classifying files for each packer type using the learning model after extracting features for the files to be classified.