
doi: 10.2139/ssrn.6295224
Malware obfuscation has evolved significantly, yet modern detection systems often overlook the complexity and strategic usage of obfuscation techniques in real-world malware. Due to the inherent complexity of these techniques, measuring the adoption, composition, and evolution of obfuscation techniques in the malware ecosystem remains a challenging task. In this paper, we present an extensive empirical study of obfuscation patterns observed in 10,000 real-world malware samples collected over a five-year period. Leveraging a dual-pipeline framework that integrates both static and dynamic analysis within a controlled sandboxing environment, we systematically evaluate obfuscation techniques along multiple dimensions—temporal trends, technique combinations, cross-family correlations. Our findings reveal a steady increase in obfuscation complexity across malware families, characterized by a shift toward multi-category technique compositions and advanced cross family implementations, alongside a decline in simpler, standalone transformations. We also uncover that obfuscation strategies exhibit family-specific fingerprints, enabling the identification of structural relationships between known and unknown malware families. This study highlights the evolving nature of obfuscation tactics in real-world malware and emphasizes the need for scalable, pattern-aware detection methods that go beyond individual signatures to anticipate future evasion strategies and strengthen defenses against increasingly sophisticated threats.
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 0 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Average | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Average | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Average |
