IRO Journals
Journal of Soft Computing Paradigm

Are Tigress-Obfuscated Binaries Representative of Real Linux Malware? A Static Feature Measurement Study

Open Access
Published: 16 October, 2026
Pages: 373-387
  • Jayesh Gaba , Jayesh Gaba
    Department of Networking and Communications, SRM Institute of Science and Technology, Kattankulathur, India
    Department of Networking and Communications, SRM Institute of Science and Technology, Kattankulathur, India
  • Gurpreet Singh , Gurpreet Singh
    Department of Networking and Communications, SRM Institute of Science and Technology, Kattankulathur, India
    Department of Networking and Communications, SRM Institute of Science and Technology, Kattankulathur, India
  • Joseph Raymond V. Joseph Raymond V.
    Department of Networking and Communications, SRM Institute of Science and Technology, Kattankulathur, India
    Department of Networking and Communications, SRM Institute of Science and Technology, Kattankulathur, India
view PDF
view PDF

How to Cite

Gaba, Jayesh, Gurpreet Singh, and Joseph Raymond V. 2026. “Are Tigress-Obfuscated Binaries Representative of Real Linux Malware? A Static Feature Measurement Study”. Journal of Soft Computing Paradigm 8 (4): 373-87. https://doi.org/10.36548/jscp.2026.4.004.
ACM ACS APA ABNT Chicago Harvard IEEE MLA Turabian Vancouver AMA

Download Citation

Endnote/Zotero/Mendeley (RIS) BibTeX

Keywords

Malware Obfuscation
Synthetic Datasets
Tigress
Linux Malware
Static Analysis

Abstract

Malware corpora produced through source code obfuscation tools like Tigress are commonly employed for malware detection and binary analysis purposes; however, the representative nature of such malware corpora in relation to real-life Linux malware is far from sufficiently validated. This research work investigates whether binaries obfuscated via Tigress can replicate the static features of real Linux ELF malware. A total of 1,800 Linux ELF malware binaries from 2020-2025, 179 benign binaries, and 18 Tigress binaries were included in this study, 15 of which were successfully obfuscated. Section features were derived from 1,245 malware samples using the LIEF library, whereas entropy was computed for all 1,800 malware samples. Evidence of packing/obfuscation was determined via Detect-It-Easy signatures and entropy-based heuristics, after which comparative and architecture-controlled analysis was conducted. Obfuscation or packing was observed in 29.6% of the malicious samples, increasing from 19.7% in 2020 to 39.0% in 2025. The mean section entropy was higher for packed malware when compared to Tigress obfuscated binaries (6.98 vs. 5.90) and remained higher in the x86/x86-64 subset (6.91 vs. 5.90). Signature-based detection found 21.8% of the samples, whereas the entropy-based heuristic found 7.8% in total, but without any overlap. The distribution of sections was also significantly different between Tigress obfuscated binaries and packed malware. The considered configurations of Tigress thus fail to emulate several key static properties seen in the analysed set of Linux malwares.

References

  1. You, Ilsun, and Kangbin Yim. "Malware Obfuscation Techniques: A Brief Survey." In 2010 International Conference on Broadband, Wireless Computing, Communication and Applications, IEEE, 2010, 297-300.
  2. Roundy, Kevin A., and Barton P. Miller. "Hybrid Analysis and Control of Malware." In International Workshop on Recent Advances in Intrusion Detection, Berlin, Heidelberg: Springer Berlin Heidelberg, 2010, 317-338.
  3. C. Collberg, "Tigress C Diversifier/Obfuscator," http://tigress.cs.arizona.edu, 2016, accessed: 2024.
  4. He, Jingxuan, Pesho Ivanov, Petar Tsankov, Veselin Raychev, and Martin Vechev. "Debin: Predicting Debug Information in Stripped Binaries." In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, 1667-1680.
  5. Luo, Lannan, Jiang Ming, Dinghao Wu, Peng Liu, and Sencun Zhu. "Semantics-based Obfuscation-Resilient Binary Code Similarity Comparison with Applications to Software Plagiarism Detection." In Proceedings of the 22nd ACM SIGSOFT international symposium on foundations of software engineering, 2014, 389-400.
  6. Xu, Xiaojun, Chang Liu, Qian Feng, Heng Yin, Le Song, and Dawn Song. "Neural Network-Based Graph Embedding for Cross-Platform Binary Code Similarity Detection." In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017, 363-376.
  7. Banescu, Sebastian, Christian Collberg, Vijay Ganesh, Zack Newsham, and Alexander Pretschner. "Code Obfuscation Against Symbolic Execution Attacks." In Proceedings of the 32nd Annual Conference on Computer Security Applications, 2016, 189-200.
  8. Schrittwieser, Sebastian, Stefan Katzenbeisser, Johannes Kinder, Georg Merzdovnik, and Edgar Weippl. "Protecting Software Through Obfuscation: Can It Keep Pace with Progress in Code Analysis?." Acm Computing Surveys (csur) 49, no. 1 (2016): 1-37.
  9. Cauligi, Sunjay, Craig Disselkoen, Daniel Moghimi, Gilles Barthe, and Deian Stefan. "SoK: Practical Foundations for Software Spectre Defenses." In 2022 IEEE Symposium on Security and Privacy (SP), IEEE, 2022, 666-680.
  10. Ugarte-Pedrero, Xabier, Davide Balzarotti, Igor Santos, and Pablo G. Bringas. "SoK: Deep Packer Inspection: A Longitudinal Study of the Complexity of Run-Time Packers." In 2015 IEEE Symposium on Security and Privacy, IEEE, 2015, 659-673.
  11. R. Perdisci, A. Lanzi, and W. Lee, "Classification of Packed Executables for Accurate Computer Virus Detection," Pattern Recognition Letters, vol. 29, no. 14, 2008, 1941–1946.
  12. Shafiq, M. Zubair, S. Momina Tabish, Fauzan Mirza, and Muddassar Farooq. "Pe-miner: Mining Structural Information to Detect Malicious Executables in Realtime." In International Workshop on Recent Advances in Intrusion Detection, Berlin, Heidelberg: Springer Berlin Heidelberg, 2009, 121-141.
  13. Antonakakis, Manos, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric et al. "Understanding the Mirai Botnet." In 26th USENIX Security Symposium (USENIX Security 17), pp. 1093-1110. 2017.
  14. Kolias, Constantinos, Georgios Kambourakis, Angelos Stavrou, and Jeffrey Voas. "DDoS in the IoT: Mirai and Other Botnets." computer 50, no. 7 (2017): 80-84.
  15. Pa, Yin Minn Pa, Shogo Suzuki, Katsunari Yoshioka, Tsutomu Matsumoto, Takahiro Kasama, and Christian Rossow. "{IoTPOT}: Analysing the Rise of {IoT} Compromises." In 9th USENIX Workshop on Offensive Technologies (WOOT 15). 2015.
  16. abuse.ch, "MalwareBazaar: Malware Sample Sharing Platform," https://bazaar.abuse.ch, 2024.
  17. horsicq, "Detect It Easy (DIE)," https://github.com/horsicq/Detect-It-Easy, 2024.
  18. Lyda, Robert, and James Hamrock. "Using entropy analysis to find encrypted and packed malware." IEEE security & privacy 5, no. 2 (2007): 40-45.
  19. Marzano, Artur, David Alexander, Osvaldo Fonseca, Elverton Fazzion, Cristine Hoepers, Klaus Steding-Jessen, Marcelo HPC Chaves, Ítalo Cunha, Dorgival Guedes, and Wagner Meira. "The evolution of bashlite and mirai iot botnets." In 2018 IEEE Symposium on Computers and Communications (ISCC), pp. 00813-00818. IEEE, 2018.
  20. De Donno, Michele, Nicola Dragoni, Alberto Giaretta, and Angelo Spognardi. "DDoS-capable IoT malwares: comparative analysis and Mirai investigation." Security and Communication Networks 2018, no. 1 (2018): 7178164.
  21. UPX Team, "UPX: The Ultimate Packer for eXecutables," https://upx.github.io, 2024.
  22. Cozzi, Emanuele, Mariano Graziano, Yanick Fratantonio, and Davide Balzarotti. "Understanding Linux Malware." In 2018 IEEE Symposium on Security and Privacy (SP), IEEE, 2018, 161-175.
  23. Bekerman, Dmitri, Bracha Shapira, Lior Rokach, and Ariel Bar. "Unknown Malware Detection Using Network Traffic Classification." In 2015 IEEE Conference on Communications and Network Security (CNS), IEEE, 2015, 134-142.
  24. CRossow, Christian, Dennis Andriesse, Tillmann Werner, Brett Stone-Gross, Daniel Plohmann, Christian J. Dietrich, and Herbert Bos. "Sok: P2pwned-Modeling and Evaluating the Resilience of Peer-to-Peer Botnets." In 2013 IEEE Symposium on Security and Privacy, IEEE, 2013, 97-111.
  25. Wang, Chenxi, Jonathan Hill, John Knight, and Jack Davidson. Software Tamper Resistance: Obstructing Static Analysis of Programs. Technical Report CS-2000-12, University of Virginia, 12 2000, 2000.
  26. Sharif, Monirul Islam, Andrea Lanzi, Jonathon T. Giffin, and Wenke Lee. "Impeding Malware Analysis Using Conditional Code Obfuscation." In NDSS. 2008.
  27. Collberg, Christian, Clark Thomborson, and Douglas Low. A Taxonomy of Obfuscating Transformations. 1997.
  28. Junod, Pascal, Julien Rinaldini, JohanWehrli, and Julie Michielin. "Obfuscator-LLVM--Software Protection for the Masses." In 2015 ieee/acm 1st international workshop on software protection, IEEE, 2015, 3-9.
  29. VMProtect Software, "VMProtect Software Protection," https://vmpsoft.com, 2024.
  30. PEiD Team, "PEiD: PE Identifier," https://www.aldeid.com/wiki/PEiD, 2024.
  31. Dahl, George E., Jack W. Stokes, Li Deng, and Dong Yu. "Large-scale Malware Classification Using Random Projections and Neural Networks." In 2013 IEEE International Conference on Acoustics, Speech and Signal Processing, IEEE, 2013, 3422-3426.
  32. Raff, E., J. Barker, J. Sylvester, R. Brandon, B. Catanzaro, and C. Nicholas. "Malware Detection by Eating a Whole Executable." In Proceedings of the AAAI Conference on Artificial Intelligence, vol. 33, 2018, 268-276.
  33. Anderson, Hyrum S., Anant Kharkar, Bobby Filar, David Evans, and Phil Roth. "Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning." arXiv preprint arXiv:1801.08917 (2018).
  34. Rossow, Christian, Christian J. Dietrich, Chris Grier, Christian Kreibich, Vern Paxson, Norbert Pohlmann, Herbert Bos, and Maarten Van Steen. "Prudent Practices for Designing Malware Experiments: Status Quo and Outlook." In 2012 IEEE Symposium on Security and privacy, IEEE, 2012, 65-79.
  35. Thomas, Romain. "Lief-library to Instrument Executable Formats (2017)." URL: https://lief.quark slab. com.
  36. Zhou, Dongchao, Lingyun Ying, Huajun Chai, and Dongbin Wang. "From Obfuscated to Obvious: A Comprehensive JavaScript Deobfuscation Tool for Security Analysis." arXiv preprint arXiv:2512.14070 (2025).
  37. Zhou, Yongxin, Alec Main, Yuan X. Gu, and Harold Johnson. "Information Hiding In Software with Mixed Boolean-Arithmetic Transforms." In International Workshop on Information Security Applications, Berlin, Heidelberg: Springer Berlin Heidelberg, 2007, 61-75.
  38. J. Cohen, Statistical Power Analysis for the Behavioral Sciences, 2nd ed. Hillsdale, NJ: Lawrence Erlbaum Associates, 1988.