International Conference on Semantic Computing (ICSC 2007)
A Software Birthmark Based on Dynamic Opcode n-gram
Irvine, California
September 17-September 19
ISBN: 0-7695-2997-6
Bin Lu, Zhengzhou Information Science and Technology Institute, China
Fenlin Liu, Zhengzhou Information Science and Technology Institute, China
Xin Ge, Zhengzhou Information Science and Technology Institute, China
Bin Liu, Zhengzhou Information Science and Technology Institute, China
Xiangyang Luo, Zhengzhou Information Science and Technology Institute, China
A kind of dynamic opcode n-gram software birthmark is proposed in this paper based on Myles? software birthmark (in which static opcode n-gram set is regarded as the software birthmark). The dynamic opcode n-gram set is regarded as the software birthmark which is extracted from the dynamic executable instruction sequence of the program. And the new birthmark can not only keep the advantages of feature n-gram set based on static opcode, but also possesses high robustness to code compression, encryption, packing. The algorithm which is to evaluate the similarity of the birthmarks of two programs is improved employing the theory of Probability and Statistic. As a result, the time complexity of the improved algorithm decreases to O(n) from O(n^2 ) , while the space complexity keeps unchanged. Finally, the validity of the scheme is proved by experiments.
Citation:
Bin Lu, Fenlin Liu, Xin Ge, Bin Liu, Xiangyang Luo, "A Software Birthmark Based on Dynamic Opcode n-gram," icsc, pp.37-44, International Conference on Semantic Computing (ICSC 2007), 2007
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb