When Coding Style Survives Compilation: De-anonymizing Programmers from Executable Binaries

Abstract

The ability to identify authors of computer programs based on their coding style is a direct threat to the privacy and anonymity of programmers. While recent work found that source code can be attributed to authors with high accuracy, attribution of executable binaries appears to be much more difficult. Many distinguishing features present in source code, e.g. variable names, are removed in the compilation process, and compiler optimization may alter the structure of a program, further obscuring features that are known to be useful in determining authorship. We examine programmer de-anonymization from the standpoint of machine learning, using a novel set of features that include ones obtained by decompiling the executable binary to source code. We adapt a powerful set of techniques from the domain of source code authorship attribution along with stylistic representations embedded in assembly, resulting in successful deanonymization of a large set of programmers.We evaluate our approach on data from the Google Code Jam, obtaining attribution accuracy of up to 96% with 100 and 83% with 600 candidate programmers. We present an executable binary authorship attribution approach, for the first time, that is robust to basic obfuscations, a range of compiler optimization settings, and binaries that have been stripped of their symbol tables. We perform programmer de-anonymization using both obfuscated binaries, and real-world code found "in the wild" in single-author GitHub repositories and the recently leaked Nulled.IO hacker forum. We show that programmers who would like to remain anonymous need to take extreme countermeasures to protect their privacy.

MemGuard

“…To address the challenges of achieving formal utility-loss guarantees, e.g., 0 label loss and bounded confidence score distortion, we design new methods to find adversarial examples. Other than membership inference attacks, many other attacks rely on machine learning classifiers, e.g., attribute inference attacks [11,17,28], website fingerprinting attacks [7,22,29,46,67], side-channel attacks [73], location attacks [5,45,52,72], and author identification attacks [8,41]. For instance, online social network users are vulnerable to attribute inference attacks, in which an attacker leverages a machine learning classifier to infer users' private attributes (e.g., gender, political view, and sexual orientation) using their public data (e.g., page likes) on social networks.…”

An attempt toward Authorship Analysis of Obfuscated .NET Binaries

“…When the unpacking routine has finished its run, the execution pointer jumps to the first instruction of the original program. For example, UPX (Ultimate Packer for Executables) 3 is a free and open-source executable packer which mainly compresses the executable rather than obfuscating them. Authors may use this technique for faster loading their program into memory due to low file size.…”

“…In some prominent studies such as [14], [2], authors have utilized machine learning techniques to correlate syntax-based features with authorship to identify the author of program binaries. In [3], authors have analyzed the effects of compiler optimization (in three levels), removing symbol information and applying basic binary obfuscation methods (such as instruction replacement and control flow graph obfuscation) on several features mainly obtained from disassembling and decompiling the executable binaries (e.g. token n-grams and features driven from the Abstract Syntax Tree).…”

Recognizing and Imitating Programmer Style: Adversaries in Program Authorship Attribution

“…Rosenblum et al [21] apply machine learning to style features extracted from binaries; Caliskan-Islam et al [6] build on this work. Muir and Wikström [17] find that changing compiler settings and linking statically can be used to decrease attribution accuracy and obfuscate authorship on binary attribution classifiers -the only other work, to our knowledge, focused on authorship obfuscation for programs.…”