On the Automatic Analysis of the Practical Resistance of Obfuscating Transformations

Borisov, Petr Dmitrievich; Kosolapov, Y. V.

doi:10.3103/s0146411620070044

Cited by 5 publications

(2 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…В рамках такого определения похожести две программы, например, реализующие разные алгоритмы сортировки и возвращающие на одинаковых входных данных одинаковый результат, считаются непохожими. И хотя такое определение существенно сужает класс пар похожих программ, оно представляется удобным в рамках следующей модели оценки стойкости обфусцирующих преобразований, предложенной в [5]. Пусть 𝑆𝑖𝑚𝑖𝑙𝑎𝑟𝑖𝑡𝑦 -метод вычисления похожести двух программ, возвращающий действительное число из диапазона [0,1], где 0 -программы похожи, 1 -непохожи.…”

Section: введение и постановка задачиunclassified

“…В методе 𝑆𝑖𝑚𝑖𝑙𝑎𝑟𝑖𝑡𝑦 при сравнении P и Q могут учитываться как статические характеристики, получаемые без запуска программ, так и динамические, вычисляемые в результате запуска или симуляции запуска. В [7,8] исследуется возможность применения в 𝑆𝑖𝑚𝑖𝑙𝑎𝑟𝑖𝑡𝑦 в качестве динамических характеристик таких, которые могут быть построены с помощью разработанной в [5] схемы получения характеристик символьного исполнения. Настоящее исследование направлено на применение в 𝑆𝑖𝑚𝑖𝑙𝑎𝑟𝑖𝑡𝑦 только статических характеристик.…”

Section: введение и постановка задачиunclassified

See 1 more Smart Citation

A Method to Evaluate Program Similarity Using Machine Learning Methods

Borisov¹,

Kosolapov²

2022

Proceedings of ISP RAS

View full text Add to dashboard Cite

The problem of constructing an algorithm for comparing two executable files is considered. The algorithm is based on the construction of similarity features vector for a given pair of programs. This vector is then used to decide on the similarity or dissimilarity of programs using machine learning methods. Similarity features are built using algorithms of two types: universal and specialized. Universal algorithms do not take into account the format of the input data (values of fuzzy hash functions, values of compression ratios). Specialized algorithms work with executable files and analyze machine code (using disassemblers). A total of 15 features were built: 9 features of the first type and 6 of the second. Based on the constructed training set of similar and dissimilar program pairs, 7 different binary classifiers were trained and tested. To build the training set, coreutils programs were used. The results of the experiments showed high accuracy of models based on random forest and k nearest neighbors. It was also found that the combined use of features of both types can improve the accuracy of classification.

show abstract

Section: введение и постановка задачиunclassified

A Method to Evaluate Program Similarity Using Machine Learning Methods

Borisov¹,

Kosolapov²

2022

Proceedings of ISP RAS

View full text Add to dashboard Cite

show abstract

The Next Evolution of Web Browser Execution Environment Performance

Toufie,

Kabaso

2023

2023 International Conference on Artificial Intelligence, Big Data, Computing and Data Communication Systems (icABCD)

View full text Add to dashboard Cite

Evaluation Methodologies in Software Protection Research

De Sutter,

Schrittwieser,

Coppens

et al. 2024

ACM Comput. Surv.

View full text Add to dashboard Cite

Man-at-the-end (MATE) attackers have full control over the system on which the attacked software runs, and try to break the confidentiality or integrity of assets embedded in the software. Both companies and malware authors want to prevent such attacks. This has driven an arms race between attackers and defenders, resulting in a plethora of different protection and analysis methods. However, it remains difficult to measure the strength of protections because MATE attackers can reach their goals in many different ways and a universally accepted evaluation methodology does not exist. This survey systematically reviews the evaluation methodologies of papers on obfuscation, a major class of protections against MATE attacks. For 571 papers, we collected 113 aspects of their evaluation methodologies, ranging from sample set types and sizes, over sample treatment, to performed measurements. We provide detailed insights into how the academic state of the art evaluates both the protections and analyses thereon. In summary, there is a clear need for better evaluation methodologies. We identify nine challenges for software protection evaluations, which represent threats to the validity, reproducibility, and interpretation of research results in the context of MATE attacks and formulate a number of concrete recommendations for improving the evaluations reported in future research papers.

show abstract

On the Automatic Analysis of the Practical Resistance of Obfuscating Transformations

Cited by 5 publications

References 23 publications

A Method to Evaluate Program Similarity Using Machine Learning Methods

A Method to Evaluate Program Similarity Using Machine Learning Methods

The Next Evolution of Web Browser Execution Environment Performance

Evaluation Methodologies in Software Protection Research

Contact Info

Product

Resources

About