On the Effectiveness of Binary Emulation in Malware Classification. (arXiv:2204.04084v1 [cs.CR])

Malware authors are continuously evolving their code base to include
counter-analysis methods that can significantly hinder their detection and
blocking. While the execution of malware in a sandboxed environment may provide
a lot of insightful feedback about what the malware actually does in a machine,
anti-virtualisation and hooking evasion methods may allow malware to bypass
such detection methods. The main objective of this work is to complement
sandbox execution with the use of binary emulation frameworks. The core idea is …

binary classification malware malware classification