A Software Birthmark Based on Dynamic Opcode n-gram

Authors:
Bin Lu;Fenlin Liu;Xin Ge;Bin Liu;Xiangyang Luo
Affiliations:
Zhengzhou Information Science and Technology Institute, China;Zhengzhou Information Science and Technology Institute, China;Zhengzhou Information Science and Technology Institute, China;Zhengzhou Information Science and Technology Institute, China;Zhengzhou Information Science and Technology Institute, China
Venue:
ICSC '07 Proceedings of the International Conference on Semantic Computing
Year:
2007

Citing 0
Cited 4

A first step towards algorithm plagiarism detection

Proceedings of the 2012 International Symposium on Software Testing and Analysis
Locating executable fragments with Concordia, a scalable, semantics-based architecture

Proceedings of the Eighth Annual Cyber Security and Information Intelligence Research Workshop
Software plagiarism detection via the static API call frequency birthmark

Proceedings of the 28th Annual ACM Symposium on Applied Computing
Measuring similarity of android applications via reversing and K-gram birthmarking

Proceedings of the 2013 Research in Adaptive and Convergent Systems

Quantified Score

Hi-index	0.00

Visualization

Abstract

A kind of dynamic opcode n-gram software birthmark is proposed in this paper based on Myles' software birthmark (in which static opcode n-gram set is regarded as the software birthmark). The dynamic opcode n-gram set is regarded as the software birthmark which is extracted from the dynamic executable instruction sequence of the program. And the new birthmark can not only keep the advantages of feature n-gram set based on static opcode, but also possesses high robustness to code compression, encryption, packing. The algorithm which is to evaluate the similarity of the birthmarks of two programs is improved employing the theory of Probability and Statistic. As a result, the time complexity of the improved algorithm decreases to O(n) from O(n^2 ) , while the space complexity keeps unchanged. Finally, the validity of the scheme is proved by experiments.