Powered by OpenAIRE graph
Found an issue? Give us feedback
addClaim

Obfuscation in the Wild: An Empirical Measurement of Obfuscation Techniques in Real-World Malware

Authors: Zhiyong Sui; Lamine Noureddine; Mst Eshita Khatun; Adam Ben Hmida; Hasan Abbas; Aakash Bansal; Aisha Ibrahim Ali-Gombe;

Obfuscation in the Wild: An Empirical Measurement of Obfuscation Techniques in Real-World Malware

Abstract

Malware obfuscation has evolved significantly, yet modern detection systems often overlook the complexity and strategic usage of obfuscation techniques in real-world malware. Due to the inherent complexity of these techniques, measuring the adoption, composition, and evolution of obfuscation techniques in the malware ecosystem remains a challenging task. In this paper, we present an extensive empirical study of obfuscation patterns observed in 10,000 real-world malware samples collected over a five-year period. Leveraging a dual-pipeline framework that integrates both static and dynamic analysis within a controlled sandboxing environment, we systematically evaluate obfuscation techniques along multiple dimensions—temporal trends, technique combinations, cross-family correlations. Our findings reveal a steady increase in obfuscation complexity across malware families, characterized by a shift toward multi-category technique compositions and advanced cross family implementations, alongside a decline in simpler, standalone transformations. We also uncover that obfuscation strategies exhibit family-specific fingerprints, enabling the identification of structural relationships between known and unknown malware families. This study highlights the evolving nature of obfuscation tactics in real-world malware and emphasizes the need for scalable, pattern-aware detection methods that go beyond individual signatures to anticipate future evasion strategies and strengthen defenses against increasingly sophisticated threats.

Related Organizations
  • BIP!
    Impact byBIP!
    selected citations
    These citations are derived from selected sources.
    This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    0
    popularity
    This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
    Average
    influence
    This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    Average
    impulse
    This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
    Average
Powered by OpenAIRE graph
Found an issue? Give us feedback
selected citations
These citations are derived from selected sources.
This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Citations provided by BIP!
popularity
This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
BIP!Popularity provided by BIP!
influence
This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Influence provided by BIP!
impulse
This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
BIP!Impulse provided by BIP!
0
Average
Average
Average
Upload OA version
Are you the author of this publication? Upload your Open Access version to Zenodo!
It’s fast and easy, just two clicks!