Characterizing and Codifying Malware Sophistication

Abstract

'Sophisticated' is widely used to describe malware, yet it lacks a consistent definition within academic literature. While existing software quality and complexity metrics offer some insight into malware structure, they do not capture the broader adversarial and operational traits that contribute to real-world threat potential. This paper presents a systematization of existing approaches for assessing malware quality using static binary analysis. We define malware sophistication through a quality-focused lens by reinterpreting select characteristics from the ISO/IEC 25010 software quality standard, including reliability, maintainability, flexibility, and security, and evaluating their applicability to malware binaries. We identify which characteristics are both relevant to malware and measurable through static analysis, forming the basis for future frameworks that consistently assess malware sophistication when source code is unavailable or dynamic execution is infeasible.

7 pages, 2 tables, published at 2026 Intermountain Engineering, Technology and Computing (IETC)

References in corpus (4)

• Revisiting Binary Code Similarity Analysis using Interpretable Feature Engineering and Lessons Learned
• Arms Race in Adversarial Malware Detection: A Survey
• Adapting Novelty towards Generating Antigens for Antivirus systems
• Wicked Problem, Parsimonious Solution: Securing Electric Vehicle Charging Station Software