Layered obfuscation: a taxonomy of software obfuscation techniques for layered security

Abstract

Software obfuscation has been developed for over 30 years. A problem always confusing the communities is what security strength the technique can achieve. Nowadays, this problem becomes even harder as the software economy becomes more diversified. Inspired by the classic idea of layered security for risk management, we propose layered obfuscation as a promising way to realize reliable software obfuscation. Our concept is based on the fact that real-world software is usually complicated. Merely applying one or several obfuscation approaches in an ad-hoc way cannot achieve good obscurity. Layered obfuscation, on the other hand, aims to mitigate the risks of reverse software engineering by integrating different obfuscation techniques as a whole solution. In the paper, we conduct a systematic review of existing obfuscation techniques based on the idea of layered obfuscation and develop a novel taxonomy of obfuscation techniques. Following our taxonomy hierarchy, the obfuscation strategies under different branches are orthogonal to each other. In this way, it can assist developers in choosing obfuscation techniques and designing layered obfuscation solutions based on their specific requirements.

Function-Level Compilation Provenance Identification with Multi-Faceted Neural Feature Distillation and Fusion

“…MulCPI's effectiveness may be hindered by the diverse code obfuscation strategies [47,48] applied to the code under analysis. Techniques such as compression and encryption can disrupt the initial analysis phase by preventing accurate function parsing and extraction, which are critical for MulCPI and other function-level analysis methods.…”

Antivirus Performance Evaluation Against Powershell Obfuscated Malware

“…Obfuscation -consists of sub techniques for modifying the code of the malware to change its signatures and make it more difficult to detect [10]. This includes modifying/reorganizing the source code, object concatenation, splitting and merging techniques so the new relevant signatures are not flagged as malicious [11].…”

Vehicle Security: A Survey of Security Issues and Vulnerabilities, Malware Attacks and Defenses

“…Malware also can use this technique on vehicles to spread its activity across multiple ECUs' threads in order to evade detection. Other sorts of malware can add dummy instructions to their code to make it look different [244], or use instruction substitution to change their code by substituting equivalent instructions for some of them [245], or use code transposition to reorder the sequence of instructions in their code [246] , or use subroutine reordering to obfuscate their code by randomly rearranging their subroutines [247]. Consequently, malware can evade detection and avoid itself from being properly analyzed by employing such techniques.…”