Packed Code Detection using Shannon Entropy and Homomorphic Encrypted Executables

Static analysis of portable executable (PE) files represents a powerful tool for malware detection without running the code. A feature that can be extracted from the files during static analysis is the Shannon entropy, which is an indicator for packed binaries. Packers can be used for legitimate reasons, such as the protection of the source code, but they are often used by malware in order to hide malicious code. Multiple security solutions perform in-the-cloud file scanning in order to detect malware. However, users may be reluctant to upload their files to the cloud, especially in the case of executables that can contain private data, such as embedded resources or self-extracting archives. Homomorphic encryption (HE) represents a possible solution, as it allows the cloud servers to scan files sent by the clients directly in encrypted form. In this paper, we propose a method for computing the Shannon entropy of a plaintext string given only the corresponding homomorphic encrypted string. The encrypted entropy value can be further used, along with other encrypted static features from the PE file, by a privacy-preserving machine learning (ML) model for malware detection. In the first set of experiments, we analyzed the efficiency of the proposed method and we obtained reasonable entropy computation times for strings containing 1000 hexadecimal characters: 55.65 seconds with single-threading, respectively 19.75 seconds with multi-threading. In the second set of experiments, we demonstrated that, although the Shannon entropy is generally computed at the byte level, evaluating the entropy for hexadecimal characters represents a reliable method for identifying Packed PE files.