Efficient SVM Based Packer Identification with Binary Diffing Measures

Packer identification is an essential process followed by further investigation on malware. For efficient packer identification, we introduce an SVM based automatized method, which uses kernel lifting with binary diffing measures for RBF kernels. According to the experimental results, we found that LCS, n-gram and other binary diffing measure serve kernels with better performance in packer identification than previous works, which has used traditional kernels or no kernel-lifting at all. In addition, Edit distance-based RBF kernels in previous works (e.g., [6]) do not show satisfying results compared to other binary diffing measure-based kernels.