Structural Feature Based Anomaly Detection for Packed Executable Identification - Computational Intelligence in Security for Information Systems - page 237

2. McAfee Labs: Mcafee whitepaper: The good, the bad, and the unknown (2011),
http://www.mcafee.com/us/resources/white-papers/wp-good-bad-unknown.
pdf
3. PEiD: PEiD webpage (2010), http://www.peid.info/
4. Faster Universal Unpacker (1999), http://code.google.com/p/fuu/
5. Morgenstern, M., Pilz, H.: Useful and useless statistics about viruses and anti-
virus programs. In: Proceedings of the CARO Workshop (2010), www.f-secure.
com/weblog/archives/Maik_Morgenstern_Statistics.pdf
6. Babar, K., Khalid, F.: Generic unpacking techniques. In: Proceedings of the 2 nd
International Conference on Computer, Control and Communication (IC4), pp.
1-6. IEEE, Los Alamitos (2009)
7. Data Rescue: Universal PE Unpacker plug-in, http://www.datarescue.com/
idabase/unpack_pe
8. Stewart, J.: Ollybone: Semi-automatic unpacking on ia-32. In: Proceedings of the
14 th DEF CON Hacking Conference (2006)
9. Royal, P., Halpin, M., Dagon, D., Edmonds, R., Lee, W.: Polyunpack: Automating
the hidden-code extraction of unpack-executing malware. In: Proceedings of the
2006 Annual Computer Security Applications Conference (ACSAC), pp. 289-300
(2006)
10. Kang, M., Poosankam, P., Yin, H.: Renovo: A hidden code extractor for packed
executables. In: Proceedings of the 2007 ACM Workshop on Recurring Malcode,
pp. 46-53. ACM, New York (2007)
11. Martignoni, L., Christodorescu, M., Jha, S.: Omniunpack: Fast, generic, and safe
unpacking of malware. In: Proceedings of the 2007 Annual Computer Security
Applications Conference (ACSAC), pp. 431-441 (2007)
12. Yegneswaran, V., Saidi, H., Porras, P., Sharif, M., Mark, W.: Eureka: A framework
for enabling static analysis on malware. Technical report, Technical Report SRI-
CSL-08-01 (2008)
13. Danielescu, A.: Anti-debugging and anti-emulation techniques. CodeBreakers Jour-
nal 5(1) (2008), http://www.codebreakers-journal.com/
14. Cesare, S.: Linux anti-debugging techniques, fooling the debugger (1999), http://
vx.netlux.org/lib/vsc04.html
15. Julus, L.: Anti-debugging in WIN32 (1999), http://vx.netlux.org/lib/vlj05.
html
16. Farooq, M.: PE-Miner: Mining Structural Information to Detect Malicious Exe-
cutables in Realtime. In: Proceedings of the 12 th International Symposium on Re-
cent Advances in Intrusion Detection (RAID), pp. 121-141. Springer, Heidelberg
(2009)
17. Shafiq, M., Tabish, S., Farooq, M.: PE-Probe: Leveraging Packer Detection and
Structural Information to Detect Malicious Portable Executables. In: Proceedings
of the Virus Bulletin Conference (VB), pp. 29-33 (2009)
18. Perdisci, R., Lanzi, A., Lee, W.: McBoost: Boosting scalability in malware col-
lection and analysis using statistical classification of executables. In: Proceed-
ings of the 2008 Annual Computer Security Applications Conference (ACSAC),
pp. 301-310 (2008)
19. Kent, J.: Information gain and a general measure of correlation. Biometrika 70(1),
163-173 (1983)
20. Tata, S., Patel, J.: Estimating the Selectivity of tf-idf based Cosine Similarity
Predicates. SIGMOD Record 36(2), 75-80 (2007)
21. VX Heavens, http://vx.netlux.org/