In order to resolve the issue of FFRI Dataset scripts, we evaluated some existing OSS packer detection tools.
In this repository, we compare the performance of tools that provide heuristic packer detections (e.g., few import APIs, existence of sections with high entropy, broken rich header, ...).
Note that we previously published similar repository PackerDetectionToolEvaluation, but it focused on the evaluation of signature-based packer detection tools.
We use PackingData dataset for this evaluation.
Note that we fixed the issue of PackingData for this evaluation.
TPR is almost the same between PyPacker and Manalyze; its value is about 94%. The performance of pypeid is slightly lower than these two tools.
On the other hand, FPR was much lower when using PyPacker or pypeid compared with Manalyze.
| TPR | FPR | |
|---|---|---|
| PyPackerDetect | 94.6% | 2.2% |
| Manalyze | 95.0% | 41.0% |
| pypeid | 84.9% | 5.6% |
See Jupyter Notebook for more details.
Koh M. Nakagawa. © FFRI Security, Inc. 2020