On the Automatic Analysis of the Practical Resistance of Obfusting Transformations
A method is developed for assessing the practical persistence of obfuscating transformations of programs based on the calculation of the similarity index for the original, obfuscated and deobfuscated programs. Candidates are proposed for similarity indices, which are based on such program characteri...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Yaroslavl State University
2019-09-01
|
| Series: | Моделирование и анализ информационных систем |
| Subjects: | |
| Online Access: | https://www.mais-journal.ru/jour/article/view/1226 |
| _version_ | 1826559021275938816 |
|---|---|
| author | Petr D. Borisov Yu. V. Kosolapov |
| author_facet | Petr D. Borisov Yu. V. Kosolapov |
| author_sort | Petr D. Borisov |
| collection | DOAJ |
| description | A method is developed for assessing the practical persistence of obfuscating transformations of programs based on the calculation of the similarity index for the original, obfuscated and deobfuscated programs. Candidates are proposed for similarity indices, which are based on such program characteristics as the control flow graph, symbolic execution time and degree of coverage for symbolic execution. The control flow graph is considered as the basis for building other candidates for program similarity indicators. On its basis, a new candidate is proposed for the similarity index, which, when calculated, finds the Hamming distance between the adjacency matrices of control flow graphs of compared programs. A scheme for estimating (analyzing) the persistence of obfuscating transformations is constructed, according to which for the original, obfuscated and deobfuscated programs, the characteristics of these programs are calculated and compared in accordance with the chosen comparison model. The developed scheme, in particular, is suitable for comparing programs based on similarity indices. This paper develops and implements one of the key units of the constructed scheme - a block for obtaining program characteristics compiled for the x86/x86 64 architecture. The developed unit allow to find the control flow graph, the time for symbolic execution and the degree of coverage for symbolic execution. Some results of work of the constructed block are given. |
| first_indexed | 2024-04-10T02:25:54Z |
| format | Article |
| id | doaj.art-412621e1052c453082e8f351832c6bec |
| institution | Directory Open Access Journal |
| issn | 1818-1015 2313-5417 |
| language | English |
| last_indexed | 2025-03-14T08:53:45Z |
| publishDate | 2019-09-01 |
| publisher | Yaroslavl State University |
| record_format | Article |
| series | Моделирование и анализ информационных систем |
| spelling | doaj.art-412621e1052c453082e8f351832c6bec2025-03-02T12:46:52ZengYaroslavl State UniversityМоделирование и анализ информационных систем1818-10152313-54172019-09-0126331733110.18255/1818-1015-2019-3-317-331912On the Automatic Analysis of the Practical Resistance of Obfusting TransformationsPetr D. Borisov0Yu. V. Kosolapov1Southern Federal UniversitySouthern Federal UniversityA method is developed for assessing the practical persistence of obfuscating transformations of programs based on the calculation of the similarity index for the original, obfuscated and deobfuscated programs. Candidates are proposed for similarity indices, which are based on such program characteristics as the control flow graph, symbolic execution time and degree of coverage for symbolic execution. The control flow graph is considered as the basis for building other candidates for program similarity indicators. On its basis, a new candidate is proposed for the similarity index, which, when calculated, finds the Hamming distance between the adjacency matrices of control flow graphs of compared programs. A scheme for estimating (analyzing) the persistence of obfuscating transformations is constructed, according to which for the original, obfuscated and deobfuscated programs, the characteristics of these programs are calculated and compared in accordance with the chosen comparison model. The developed scheme, in particular, is suitable for comparing programs based on similarity indices. This paper develops and implements one of the key units of the constructed scheme - a block for obtaining program characteristics compiled for the x86/x86 64 architecture. The developed unit allow to find the control flow graph, the time for symbolic execution and the degree of coverage for symbolic execution. Some results of work of the constructed block are given.https://www.mais-journal.ru/jour/article/view/1226code obfuscationresistancesymbolic execution |
| spellingShingle | Petr D. Borisov Yu. V. Kosolapov On the Automatic Analysis of the Practical Resistance of Obfusting Transformations Моделирование и анализ информационных систем code obfuscation resistance symbolic execution |
| title | On the Automatic Analysis of the Practical Resistance of Obfusting Transformations |
| title_full | On the Automatic Analysis of the Practical Resistance of Obfusting Transformations |
| title_fullStr | On the Automatic Analysis of the Practical Resistance of Obfusting Transformations |
| title_full_unstemmed | On the Automatic Analysis of the Practical Resistance of Obfusting Transformations |
| title_short | On the Automatic Analysis of the Practical Resistance of Obfusting Transformations |
| title_sort | on the automatic analysis of the practical resistance of obfusting transformations |
| topic | code obfuscation resistance symbolic execution |
| url | https://www.mais-journal.ru/jour/article/view/1226 |
| work_keys_str_mv | AT petrdborisov ontheautomaticanalysisofthepracticalresistanceofobfustingtransformations AT yuvkosolapov ontheautomaticanalysisofthepracticalresistanceofobfustingtransformations |