How Far Does Entropy Go? Duplicates, Confounding, Drift and Padding in Entropy-Based Detection of Malicious PE Files
This paper demonstrates that entropy-based detection of malicious PE files is severely compromised by data duplicates, size confounding, and adversarial padding, revealing that such models largely memorize known sections and can be easily evaded by appending benign-looking bytes, thereby necessitating more robust detection strategies.