Behavior based software theft detection

Wang, Xinran; Jhi, Yoon-Chan; Zhu, Sencun; Liu, Peng

doi:10.1145/1653662.1653696

Cited by 82 publications

(65 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, attackers may simply embed some of API implementations into their program so that fewer API calls will be observed. Wang et al [38] proposed a system call based birthmark, addressing the problems with API based techniques. However, the proposed technique cannot be applied to computation oriented softwares containing few system calls, and is sill vulnerable to injecting transparent system calls in the middle of an edge on the system call dependence graph.…”

Section: State Of the Artmentioning

confidence: 99%

Value-based program characterization and its application to software plagiarism detection

Jhi

Wang

Jia

et al. 2011

Proceedings of the 33rd International Conference on Software Engineering

Self Cite

View full text Add to dashboard Cite

Identifying similar or identical code fragments becomes much more challenging in code theft cases where plagiarizers can use various automated code transformation techniques to hide stolen code from being detected. Previous works in this field are largely limited in that (1) most of them cannot handle advanced obfuscation techniques; (2) the methods based on source code analysis are less practical since the source code of suspicious programs is typically not available until strong evidences are collected; and (3) those depending on the features of specific operating systems or programming languages have limited applicability.Based on an observation that some critical runtime values are hard to be replaced or eliminated by semanticspreserving transformation techniques, we introduce a novel approach to dynamic characterization of executable programs. Leveraging such invariant values, our technique is resilient to various control and data obfuscation techniques. We show how the values can be extracted and refined to expose the critical values and how we can apply this runtime property to help solve problems in software plagiarism detection. We have implemented a prototype with a dynamic taint analyzer atop a generic processor emulator. Our experimental results show that the value-based method successfully discriminates 34 plagiarisms obfuscated by SandMark, plagiarisms heavily obfuscated by KlassMaster, programs obfuscated by Thicket, and executables obfuscated by Loco/Diablo.

show abstract

Section: State Of the Artmentioning

confidence: 99%

Value-based program characterization and its application to software plagiarism detection

Jhi

Wang

Jia

et al. 2011

Proceedings of the 33rd International Conference on Software Engineering

Self Cite

View full text Add to dashboard Cite

show abstract

“…Wang et al [11] proposed a system call dependency graph birthmark software theft detection system. Software birthmarks have been defined as unique characteristics that a program possesses and can be used to identify the program without the need for source code, a dynamic analysis tool is used in [19] to generate system call trace and SCDGS to detect software component theft.…”

Section: Related Workmentioning

confidence: 99%

Multi-dimensional key generation of ICMetrics for cloud computing

et al. 2015

View full text Add to dashboard Cite

Despite the rapid expansion and uptake of cloud based services, lack of trust in the provenance of such services represents a significant inhibiting factor in the further expansion of such service. This paper explores an approach to assure trust and provenance in cloud based services via the generation of digital signatures using properties or features derived from their own construction and software behaviour. The resulting system removes the need for a server to store a private key in a typical Public/Private-Key Infrastructure for data sources. Rather, keys are generated at run-time by features obtained as service execution proceeds. In this paper we investigate several potential software features for suitability during the employment of a cloud service identification system. The generation of stable and unique digital identity from features in Cloud computing is challenging because of the unstable operation environments that implies the features employed are likely to vary under normal operating conditions. To address this, we introduce a multi-dimensional key generation technology which maps from multi-dimensional feature space directly to a key space. Subsequently, a smooth entropy algorithm is developed to evaluate the entropy of key space.

show abstract

“…Software birthmarks have been defined as unique characteristics that a program possesses and can be used to identify the program. Without the need for source code, a dynamic analysis tool is used in [18] to generate system call trace and SCDGs to detect software component theft.…”

Section: Related Workmentioning

confidence: 99%

Exploring ICMetrics to detect abnormal program behaviour on embedded devices

Zhai

Appiah

Ehsan

et al. 2015

Journal of Systems Architecture

View full text Add to dashboard Cite

Abstract-Execution of unknown or malicious software on an embedded system may trigger harmful system behaviour targeted at stealing sensitive data and/or causing damage to the system. It is thus considered a potential and significant threat to the security of embedded systems. Generally, the resource constrained nature of Commercial offthe-shelf (COTS) embedded devices, such as embedded medical equipment, does not allow computationally expensive protection solutions to be deployed on these devices, rendering them vulnerable. A Self-Organising Map (SOM) based and Fuzzy C-means based approaches are proposed in this paper for detecting abnormal program behaviour to boost embedded system security. The presented technique extracts features derived from processor's Program Counter (PC) and Cycles per Instruction (CPI), and then utilises the features to identify abnormal behaviour using the SOM. Results achieved in our experiment show that the proposed SOM based and Fuzzy C-means based methods can identify unknown program behaviours not included in the training set with 90.9% and 98.7% accuracy.Index Terms-Embedded system security, abnormal behaviour detection, intrusion detection, Self-Organising Map.

show abstract

Behavior based software theft detection

Cited by 82 publications

References 24 publications

Value-based program characterization and its application to software plagiarism detection

Value-based program characterization and its application to software plagiarism detection

Multi-dimensional key generation of ICMetrics for cloud computing

Exploring ICMetrics to detect abnormal program behaviour on embedded devices

Contact Info

Product

Resources

About