XGBoost based Packer Identification study using Entry point

Abstract

With the development of IT technology, the number of new and variant malware is rapidly increasing. Malware developers make it difficult to analyze malware by applying techniques such as packing and obfuscation. In this paper, packing file detection and packer identification were tested using N bytes of data extracted from the entry point of the PE file as a feature. To verify the feature performance, the ensemble model XGBoost algorithm was used. As a result, the packing file was detected with an accuracy of 97.45% and the packer was identified with an accuracy of 98.41%. Through the experiment, it was confirmed that the feature extracted from the entry point is significant for the packing file detection and the packer detection.