Packer Identification Method for Multi-Layer Executables Using Entropy Analysis with k-Nearest Neighbor Algorithm

摘要

The damage cost caused by malware has been increasingin the world. Usually, malwares are packed so that it is not detected. It isa hard task even for professional malware analysts to identify the packersespecially when the malwares are multi-layer packed. In this letter, wepropose a method to identify the packers for multi-layer packed malwares byusing k-nearest neighbor algorithm with entropy-analysis for the malwares.