Are Tigress-Obfuscated Binaries Representative of Real Linux Malware? A Static Feature Measurement Study

Abstract

Malware corpora produced through source code obfuscation tools like Tigress are commonly employed for malware detection and binary analysis purposes; however, the representative nature of such malware corpora in relation to real-life Linux malware is far from sufficiently validated. This research work investigates whether binaries obfuscated via Tigress can replicate the static features of real Linux ELF malware. A total of 1,800 Linux ELF malware binaries from 2020-2025, 179 benign binaries, and 18 Tigress binaries were included in this study, 15 of which were successfully obfuscated. Section features were derived from 1,245 malware samples using the LIEF library, whereas entropy was computed for all 1,800 malware samples. Evidence of packing/obfuscation was determined via Detect-It-Easy signatures and entropy-based heuristics, after which comparative and architecture-controlled analysis was conducted. Obfuscation or packing was observed in 29.6% of the malicious samples, increasing from 19.7% in 2020 to 39.0% in 2025. The mean section entropy was higher for packed malware when compared to Tigress obfuscated binaries (6.98 vs. 5.90) and remained higher in the x86/x86-64 subset (6.91 vs. 5.90). Signature-based detection found 21.8% of the samples, whereas the entropy-based heuristic found 7.8% in total, but without any overlap. The distribution of sections was also significantly different between Tigress obfuscated binaries and packed malware. The considered configurations of Tigress thus fail to emulate several key static properties seen in the analysed set of Linux malwares.