Similarity Features For The Evaluation Of Obfuscation Effectiveness

Kosolapov, Y. V.; Borisov, Petr Dmitrievich

doi:10.1109/dasa51403.2020.9317301

Cited by 5 publications

(2 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…В методе 𝑆𝑖𝑚𝑖𝑙𝑎𝑟𝑖𝑡𝑦 при сравнении P и Q могут учитываться как статические характеристики, получаемые без запуска программ, так и динамические, вычисляемые в результате запуска или симуляции запуска. В [7,8] исследуется возможность применения в 𝑆𝑖𝑚𝑖𝑙𝑎𝑟𝑖𝑡𝑦 в качестве динамических характеристик таких, которые могут быть построены с помощью разработанной в [5] схемы получения характеристик символьного исполнения. Настоящее исследование направлено на применение в 𝑆𝑖𝑚𝑖𝑙𝑎𝑟𝑖𝑡𝑦 только статических характеристик.…”

Section: введение и постановка задачиunclassified

A Method to Evaluate Program Similarity Using Machine Learning Methods

Borisov¹,

Kosolapov²

2022

Proceedings of ISP RAS

View full text Add to dashboard Cite

The problem of constructing an algorithm for comparing two executable files is considered. The algorithm is based on the construction of similarity features vector for a given pair of programs. This vector is then used to decide on the similarity or dissimilarity of programs using machine learning methods. Similarity features are built using algorithms of two types: universal and specialized. Universal algorithms do not take into account the format of the input data (values of fuzzy hash functions, values of compression ratios). Specialized algorithms work with executable files and analyze machine code (using disassemblers). A total of 15 features were built: 9 features of the first type and 6 of the second. Based on the constructed training set of similar and dissimilar program pairs, 7 different binary classifiers were trained and tested. To build the training set, coreutils programs were used. The results of the experiments showed high accuracy of models based on random forest and k nearest neighbors. It was also found that the combined use of features of both types can improve the accuracy of classification.

show abstract

Section: введение и постановка задачиunclassified

A Method to Evaluate Program Similarity Using Machine Learning Methods

Borisov¹,

Kosolapov²

2022

Proceedings of ISP RAS

View full text Add to dashboard Cite

show abstract

“…В [30] предлагается значения показателей похожести, которые менее 0,05, считать незначительными. В настоящей работе эта оценка уточняется, основываясь на среднеквадратичном отклонении значений от среднего.…”

Section: результаты экспериментовunclassified

On Characteristics of Symbolic Execution in the Problem of Assessing the Quality of Obfuscating Transformations

Borisov

Косолапов

2021

Model. anal. inf. sist.

View full text Add to dashboard Cite

Obfuscation is used to protect programs from analysis and reverse engineering. There are theoretically effective and resistant obfuscation methods, but most of them are not implemented in practice yet. The main reasons are large overhead for the execution of obfuscated code and the limitation of application only to a specific class of programs. On the other hand, a large number of obfuscation methods have been developed that are applied in practice. The existing approaches to the assessment of such obfuscation methods are based mainly on the static characteristics of programs. Therefore, the comprehensive (taking into account the dynamic characteristics of programs) justification of their effectiveness and resistance is a relevant task. It seems that such a justification can be made using machine learning methods, based on feature vectors that describe both static and dynamic characteristics of programs. In this paper, it is proposed to build such a vector on the basis of characteristics of two compared programs: the original and obfuscated, original and deobfuscated, obfuscated and deobfuscated. In order to obtain the dynamic characteristics of the program, a scheme based on a symbolic execution is constructed and presented in this paper. The choice of the symbolic execution is justified by the fact that such characteristics can describe the difficulty of comprehension of the program in dynamic analysis. The paper proposes two implementations of the scheme: extended and simplified. The extended scheme is closer to the process of analyzing a program by an analyst, since it includes the steps of disassembly and translation into intermediate code, while in the simplified scheme these steps are excluded. In order to identify the characteristics of symbolic execution that are suitable for assessing the effectiveness and resistance of obfuscation based on machine learning methods, experiments with the developed schemes were carried out. Based on the obtained results, a set of suitable characteristics is determined.

show abstract

Evaluation Methodologies in Software Protection Research

De Sutter,

Schrittwieser,

Coppens

et al. 2024

ACM Comput. Surv.

View full text Add to dashboard Cite

Man-at-the-end (MATE) attackers have full control over the system on which the attacked software runs, and try to break the confidentiality or integrity of assets embedded in the software. Both companies and malware authors want to prevent such attacks. This has driven an arms race between attackers and defenders, resulting in a plethora of different protection and analysis methods. However, it remains difficult to measure the strength of protections because MATE attackers can reach their goals in many different ways and a universally accepted evaluation methodology does not exist. This survey systematically reviews the evaluation methodologies of papers on obfuscation, a major class of protections against MATE attacks. For 571 papers, we collected 113 aspects of their evaluation methodologies, ranging from sample set types and sizes, over sample treatment, to performed measurements. We provide detailed insights into how the academic state of the art evaluates both the protections and analyses thereon. In summary, there is a clear need for better evaluation methodologies. We identify nine challenges for software protection evaluations, which represent threats to the validity, reproducibility, and interpretation of research results in the context of MATE attacks and formulate a number of concrete recommendations for improving the evaluations reported in future research papers.

show abstract

Similarity Features For The Evaluation Of Obfuscation Effectiveness

Cited by 5 publications

References 9 publications

A Method to Evaluate Program Similarity Using Machine Learning Methods

A Method to Evaluate Program Similarity Using Machine Learning Methods

On Characteristics of Symbolic Execution in the Problem of Assessing the Quality of Obfuscating Transformations

Evaluation Methodologies in Software Protection Research

Contact Info

Product

Resources

About