# Analysis of Machine Learning Approaches to Packing Detection

arXiv: https://arxiv.org/abs/2105.00473 · HTML: https://mlsanity.com/paper/2105.00473/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 40 references that are in the map.
- First posted on arXiv 2 May 2021.

## Builds on (most cited first, 3 of 3)

- [Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification](https://mlsanity.com/paper/1511.04317/) (2015)
- [A Static Malware Detection System Using Data Mining Methods](https://mlsanity.com/paper/1308.2831/) (2013)
- [Semi-Supervised Learning Enabled by Multiscale Deep Neural Network Inversion](https://mlsanity.com/paper/1802.10172/) (2018)

## Built on by (most cited first, 2 of 2)

- [Assessing the Impact of Packing on Machine Learning-Based Malware Detection and Classification Systems](https://mlsanity.com/paper/2410.24017/) (2024)
- [Learning to Look Benign: Targeted Evasion of Malware Detectors via API Import Injection](https://mlsanity.com/paper/2605.18624/) (2026)

## Abstract (arXiv)

Packing is an obfuscation technique widely used by malware to hide the content and behavior of a program. Much prior research has explored how to detect whether a program is packed. This research includes a broad variety of approaches such as entropy analysis, syntactic signatures and more recently machine learning classifiers using various features. However, no robust results have indicated which algorithms perform best, or which features are most significant. This is complicated by considering how to evaluate the results since accuracy, cost, generalization capabilities, and other measures are all reasonable. This work explores eleven different machine learning approaches using 119 features to understand: which features are most significant for packing detection; which algorithms offer the best performance; and which algorithms are most economical.