Comparing Malware Evasion Theory with Practice: Results from Interviews with Expert
summary
Interviews with 24 expert analysts across 15 companies show obfuscation is the hardest evasion, followed by anti-disassembly and anti-debugger, while anti-sandbox is now manageable in practice. A systematic mapping finds 45 research papers: 19 on obfuscation and 19 on anti-sandbox, 7 on anti-debugging, but only 2 on anti-disassembly, revealing a clear gap. Researchers note deployment barriers for obfuscation fixes and pursue an interactive symbolic/forced execution tool to help analysts locate and bypass evasions.
AI-written summary · about
chapters (7)
- 0:00Malware evasion challenges
- 2:40Challenging evasion techniques
- 4:47Analysts' workflows
- 7:33Gaps between research and practice
- 9:18Research focus mapping
- 10:23Research gaps vs real needs
- 11:48Key takeaways and future work
related talks
45m"Advanced Malware Threat: handling obfuscated code using..."
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
26mAn Effective Approach to Software Obfuscation
52mFlying Under the Radar - New Security Evasion Techniques
47mJavaScript Obfuscation: It’s All About the P a c k e r s
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware
01h 03mThe Dark Side of Malware Analysis
26mMachine Learning Security Evasion Competition 2020