Program Characterization Using Runtime Values and Its Application to Software Plagiarism Detection

摘要: Illegal code reuse has become a serious threat to the software community. Identifying similar or identical fragments becomes much more challenging in theft cases where plagiarizers can use various automated transformation obfuscation techniques hide stolen from being detected. Previous works this field are largely limited that (i) most of them cannot handle advanced techniques, and (ii) methods based on source analysis not practical since suspicious programs typically be obtained until strong evidences have been collected. Based observation some critical runtime values program hard replaced eliminated by semantics-preserving we introduce novel approach dynamic characterization executable programs. Leveraging such invariant values, our technique is resilient control data techniques. We show how extracted refined expose apply property help solve problems plagiarism detection. implemented prototype with taint analyzer atop generic processor emulator. Our value-based detection method (VaPD) uses longest common subsequence similarity measuring algorithms check whether two belong same lineage. evaluate proposed through set real-world obfuscators. experimental results successfully discriminates 34 plagiarisms obfuscated SandMark, heavily KlassMaster, Thicket, executables Loco/Diablo.