An Efficient Categorization of the Instructions Based on Binary Excutables for Dynamic Software Birthmark

Lee, Dong‐Hoon; Choi, Younsung; Jung, Jaewook; Kim, Jiye; Won, Dongho

doi:10.7763/ijiet.2015.v5.570

Cited by 3 publications

(1 citation statement)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In one of our previous studies, we proposed a method of generating a birthmark into categories by grouping the opcode of instruction sequences extracted from a program [21]. In that study, the opcode was classified into categories, such as data transfer, logical, and I/O, to improve the resilience; moreover, the continuously repeating opcode was reduced to increase efficiency.…”

Section: Instruction-based Birthmarksmentioning

confidence: 99%

API-Based Software Birthmarking Method Using Fuzzy Hashing

Lee

Kang

Choi

et al. 2016

IEICE Trans. Inf. & Syst.

Self Cite

View full text Add to dashboard Cite

Donghoon LEE†a) , Dongwoo KANG †b) , Younsung CHOI † †c) , Jiye KIM †d) , Nonmembers, and Dongho WON †e) , Member SUMMARY The software birthmarking technique has conventionally been studied in fields such as software piracy, code theft, and copyright infringement. The most recent API-based software birthmarking method (Han et al., 2014) extracts API call sequences in entire code sections of a program. Additionally, it is generated as a birthmark using a cryptographic hash function (MD5). It was reported that different application types can be categorized in a program through prefiltering based on DLL/API numbers/names. However, similarity cannot be measured owing to the cryptographic hash function, occurrence of false negatives, and it is difficult to functionally categorize applications using only DLL/API numbers/names. In this paper, we propose an API-based software birthmarking method using fuzzy hashing. For the native code of a program, our software birthmarking technique extracts API call sequences in the segmented procedures and then generates them using a fuzzy hash function. Unlike the conventional cryptographic hash function, the fuzzy hash is used for the similarity measurement of data. Our method using a fuzzy hash function achieved a high reduction ratio (about 41% on average) more than an original birthmark that is generated with only the API call sequences.In our experiments, when threshold ε is 0.35, the results show that our method is an effective birthmarking system to measure similarities of the software. Moreover, our correlation analysis with top 50 API call frequencies proves that it is difficult to functionally categorize applications using only DLL/API numbers/names. Compared to prior work, our method significantly improves the properties of resilience and credibility. key words: software birthmark, birthmarking systems, software similarity, fuzzy hash, API-based sequences

show abstract

Section: Instruction-based Birthmarksmentioning

confidence: 99%

API-Based Software Birthmarking Method Using Fuzzy Hashing

Lee

Kang

Choi

et al. 2016

IEICE Trans. Inf. & Syst.

Self Cite

View full text Add to dashboard Cite

show abstract

Daav

Chae

Kim

Cho

et al. 2015

Proceedings of the 24th ACM International on Conference on Information and Knowledge Management

View full text Add to dashboard Cite

Modelling Features-Based Birthmarks for Security of End-to-End Communication System

Nazir

Khan

et al. 2020

Security and Communication Networks

View full text Add to dashboard Cite

Feature-based software birthmark is an essential property of software that can be used for the detection of software theft and many other purposes like to assess the security in end-to-end communication systems. Research on feature-based software birthmark shows that using the feature-based software birthmark joint with the practice of software birthmark estimation together can deliver a right and influential method for detecting software piracy and the amount of piracy done by a software. This can also guide developers in improving security of end-to-end communication system. Modern day software industry and systems are in demand to have an unbiased method for comparing the features-based birthmark of software competently, and more concretely for the detecting software piracy and assessing the security of end-to-end communication systems. In this paper, we proposed a mathematical model, which is based on a differential system, to present feature-based software birthmark. The model presented in this paper provides an exclusive way for the features-based birthmark of software and then can be used for comparing birthmark and assessing security of end-to-end communication systems. The results of this method show that the proposed model is efficient in terms of effectiveness and correctness for the features-based software birthmark comparison and security assessment purposes.

show abstract

An Efficient Categorization of the Instructions Based on Binary Excutables for Dynamic Software Birthmark

Cited by 3 publications

References 14 publications

API-Based Software Birthmarking Method Using Fuzzy Hashing

API-Based Software Birthmarking Method Using Fuzzy Hashing

Daav

Modelling Features-Based Birthmarks for Security of End-to-End Communication System

Contact Info

Product

Resources

About