# Assessing the Impact of Packing on Machine Learning-Based Malware Detection and Classification Systems

arXiv: https://arxiv.org/abs/2410.24017 · HTML: https://mlsanity.com/paper/2410.24017/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 22 of its 65 references that are in the map.
- First posted on arXiv 31 Oct 2024.

## Builds on (most cited first, 22 of 22)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale](https://mlsanity.com/paper/2010.11929/) (2020)
- [Swin Transformer: Hierarchical Vision Transformer using Shifted Windows](https://mlsanity.com/paper/2103.14030/) (2021)
- [EfficientNetV2: Smaller Models and Faster Training](https://mlsanity.com/paper/2104.00298/) (2021)
- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time](https://mlsanity.com/paper/1807.07838/) (2018)
- [Dos and Don'ts of Machine Learning in Computer Security](https://mlsanity.com/paper/2010.09470/) (2020)
- [Functionality-preserving Black-box Optimization of Adversarial Windows Malware](https://mlsanity.com/paper/2003.13526/) (2020)
- [Deep Neural Network Based Malware Detection Using Two Dimensional Binary Program Features](https://mlsanity.com/paper/1508.03096/) (2015)
- [Microsoft Malware Classification Challenge](https://mlsanity.com/paper/1802.10135/) (2018)
- [Classifying Sequences of Extreme Length with Constant Memory Applied to Malware Detection](https://mlsanity.com/paper/2012.09390/) (2020)
- [Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification](https://mlsanity.com/paper/1511.04317/) (2015)
- [Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection](https://mlsanity.com/paper/2008.07125/) (2020)
- [Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performance](https://mlsanity.com/paper/2307.14657/) (2023)
- [Malware Dynamic Analysis Evasion Techniques: A Survey](https://mlsanity.com/paper/1811.01190/) (2018)
- [Fast & Furious: Modelling Malware Detection as Evolving Data Streams](https://mlsanity.com/paper/2205.12311/) (2022)
- [Towards a Fair Comparison and Realistic Evaluation Framework of Android Malware Detectors based on Static Analysis and Machine Learning](https://mlsanity.com/paper/2205.12569/) (2022)
- [Fusing Feature Engineering and Deep Learning: A Case Study for Malware Classification](https://mlsanity.com/paper/2206.05735/) (2022)
- [Survey of Malware Analysis through Control Flow Graph using Machine Learning](https://mlsanity.com/paper/2305.08993/) (2023)
- [Analysis of Machine Learning Approaches to Packing Detection](https://mlsanity.com/paper/2105.00473/) (2021)
- [The Malware as a Service ecosystem](https://mlsanity.com/paper/2405.04109/) (2024)

## Built on by (most cited first, 5 of 5)

- [Adaptive Malware Detection using Sequential Feature Selection: A Dueling Double Deep Q-Network (D3QN) Framework for Intelligent Classification](https://mlsanity.com/paper/2507.04372/) (2025)
- [Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models](https://mlsanity.com/paper/2604.02490/) (2026)
- [Beyond the Wrapper: Identifying Artifact Reliance in Static Malware Classifiers using TRUSTEE](https://mlsanity.com/paper/2605.07034/) (2026)
- [Learning to Look Benign: Targeted Evasion of Malware Detectors via API Import Injection](https://mlsanity.com/paper/2605.18624/) (2026)
- [A Multi-task Mixture of Experts Framework for Malware Classification, Packing Detection, and Family Attribution](https://mlsanity.com/paper/2606.30572/) (2026)

## Abstract (arXiv)

The proliferation of malware, particularly through the use of packing, presents a significant challenge to static analysis and signature-based malware detection techniques. The application of packing to the original executable code renders extracting meaningful features and signatures challenging. To deal with the increasing amount of malware in the wild, researchers and anti-malware companies started harnessing machine learning capabilities with very promising results. However, little is known about the effects of packing on static machine learning-based malware detection and classification systems. This work addresses this gap by investigating the impact of packing on the performance of static machine learning-based models used for malware detection and classification, with a particular focus on those using visualisation techniques. To this end, we present a comprehensive analysis of various packing techniques and their effects on the performance of machine learning-based detectors and classifiers. Our findings highlight the limitations of current static detection and classification systems and underscore the need to be proactive to effectively counteract the evolving tactics of malware authors.