基于符号执行和N-scope复杂度的代码混淆度量方法

肖玉强; 郭云飞; 王亚文

doi:10.11959/j.issn.2096-109x.2022085

您当前的位置：

首页 >

文章列表页 >

基于符号执行和N-scope复杂度的代码混淆度量方法

学术论文 | 更新时间：2024-06-03

- 基于符号执行和N-scope复杂度的代码混淆度量方法
- Metrics for code obfuscation based on symbolic execution and N-scope complexity
- 网络与信息安全学报 2022年8卷第6期页码：123-134
- 作者机构：
- 作者简介：
  
  [ "肖玉强（1997- ），男，吉林辽源人，信息工程大学硕士生，主要研究方向为网络空间安全、代码混淆、机器学习" ]
  [ "郭云飞（1963- ），男，河南郑州人，信息工程大学教授、博士生导师，主要研究方向为云安全、电信网络安全、网络安全" ]
  [ "王亚文（1990- ），男，河南郑州人，信息工程大学讲师，主要研究方向为云计算、入侵容忍、网络安全" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2021YFB1006200);国家重点研发计划;The National Key R＆D Program of China(2021YFB1006201);国家自然科学基金;The National Natural Science Foundation of China(62072467)
- DOI：10.11959/j.issn.2096-109x.2022085
  中图分类号： TP393
- 网络首发：2022-12，
  
  纸质出版：2022-12-15
- 稿件说明：
移动端阅览
肖玉强, 郭云飞, 王亚文. 基于符号执行和N-scope复杂度的代码混淆度量方法[J]. 网络与信息安全学报, 2022,8(6):123-134.

Yuqiang XIAO, Yunfei GUO, Yawen WANG. Metrics for code obfuscation based on symbolic execution and N-scope complexity[J]. Chinese Journal of Network and Information Security, 2022, 8(6): 123-134.
肖玉强, 郭云飞, 王亚文. 基于符号执行和N-scope复杂度的代码混淆度量方法[J]. 网络与信息安全学报, 2022,8(6):123-134. DOI： 10.11959/j.issn.2096-109x.2022085.

Yuqiang XIAO, Yunfei GUO, Yawen WANG. Metrics for code obfuscation based on symbolic execution and N-scope complexity[J]. Chinese Journal of Network and Information Security, 2022, 8(6): 123-134. DOI： 10.11959/j.issn.2096-109x.2022085.

摘要

代码混淆可有效对抗逆向工程等各类 MATE 攻击威胁，作为攻击缓和性质的内生安全技术发展较为成熟，对代码混淆效果的合理度量具有重要价值。代码混淆度量研究相对较少，针对代码混淆弹性的度量方法与泛化性、实用性度量方法相对缺乏。符号执行技术广泛应用于反混淆攻击，其生成遍历程序完整路径输入测试集的难度可为混淆弹性度量提供参考，然而基于程序嵌套结构的对抗技术可显著降低符号执行效率，增加其混淆弹性参考误差。针对上述问题，提出结合符号执行技术和N-scope复杂度的代码混淆度量方法，该方法首先基于程序符号执行时间定义程序混淆弹性；其次提出适配符号执行的N-scope复杂度，定义程序混淆强度同时增强符号执行对多层嵌套结构程序的混淆弹性度量鲁棒性；进而提出结合动态分析与静态分析的混淆效果关联性分析，通过对程序进行符号执行与控制流图提取量化混淆效果。面向 C 程序构建了该度量方法的一种实现框架并验证，实验对3个公开程序集及其混淆后程序集约4 000个程序进行混淆效果度量，度量结果表明，提出的度量方法在较好地刻画混淆效果的同时拥有一定的泛化能力与实用价值；模拟真实混淆应用场景给出了该度量方法的使用样例，为混淆技术使用人员提供有效的混淆技术度量与技术配置参考。

Abstract

Code obfuscation has been well developed as mitigated endogenous security technology

to effectively resist MATE attacks (e.g.reverse engineering).And it also has important value for the reasonable metrics of code obfuscation effect.Since symbolic execution is widely used in anti-obfuscation attacks

metrics for code obfuscation resilience can refer to the efforts of generating input test set for executing all program paths.However

some adversarial techniques could reduce the symbol execution efficiency significantly based on the nested structure of the program and increase the error of the resilience reference.To solve the above problems

a metrics for code obfuscation was proposed based on symbolic execution and N-scope complexity.The obfuscation resilience was defined with symbolic execution time and obfuscation potency was defined based on the proposed N-scope complexity for better robustness in measuring the resilience of multi-nested structure programs.Furthermore

the correlation analysis of obfuscation effect was proposed and the effect was quantified by symbolic execution and control flow diagram extraction of programs.Over 4000 obfuscated programs from 3 open-sourced assemblies were evaluated with proposed metrics in the experiment

which indicated the generalization performance and practicality of the metrics.And an example of this metrics application was presented in a simulated obfuscation scenario which provided references of obfuscation technology metrics and obfuscation configuration for obfuscation users.

关键词

Keywords

references

AKHUNZADA A , SOOKHAK M , ANUAR N , et al . Man-at-the-end attacks:analysis,taxonomy,human aspects,motivation and future directions [J ] . Journal of Network and Computer Applications , 2015 , 48 ( 6 ): 44 - 57 .

VAN DEN BROECK J , COPPENS B , DE SUTTER B . Flexible software protection [J ] . Computers ＆ Security , 2022 , 10 ( 2 ): 6 - 36 .

耿普 , 祝跃飞 . 一种基于分支条件混淆的代码加密技术 [J ] . 计算机研究与发展 , 2019 , 56 ( 10 ): 2183 - 2192 .

GENG P , ZHU Y F . A code encrypt technique based on branch condition obfuscation [J ] . Journal of Computer Research and Development , 2019 , 56 ( 10 ): 2183 - 2192 .

陈喆 , 王志 , 王晓初 , 等 . 基于代码移动的二进制程序控制流混淆方法 [J ] . 计算机研究与发展 , 2015 , 52 ( 8 ): 1902 - 1909 .

CHEN Z , WANG Z , WANG XC , et al . Using code mobility to obfuscate control flow in binary codes [J ] . Journal of Computer Research and Development , 2015 , 52 ( 8 ): 1902 - 1909 .

AHIRE P , ABRAHAM J . Mechanisms for source code obfuscation in C:novel techniques and implementation [C ] // 2020 International Conference on Emerging Smart Computing and Informatics . 2020 .

PIZZOLOTTO D , FELLIN R , CECCATO M . OBLIVE:seamless code obfuscation for Java programs and Android Apps [C ] // 2019 IEEE 26th International Conference on Software Analysis,Evolution and Reengineering . 2019 .

VAN DEN BROECK J , COPPENS B , DE SUTTER B . Obfuscated integration of software protections [J ] . International Journal of Information Security , 2021 , 20 ( 1 ): 73 - 101 .

CECCATO M , ANDREA C , PAOLO F , et al . A large study on the effect of code obfuscation on the quality of Java code [J ] . Empirical Software Engineering , 2015 , 20 ( 6 ): 1486 - 1524 .

LARSEN P , HOMESCU A , BRUNTHALER S , et al . SoK:automated software diversity [C ] // Symposium on Security and Privacy . 2014 .

XU H , ZHOU Y , MING J , et al . Layered obfuscation:a taxonomy of software obfuscation techniques for layered security [J ] . Cybersecurity , 2020 , 3 ( 1 ): 1 - 18 .

PENG Y , CHEN Y , SHEN B . An adaptive approach to recommending obfuscation rules for java bytecode obfuscators [C ] // 2019 IEEE 43rd Annual Computer Software and Applications Conference . 2019 .

COLLBERG C , THOMBORSON C , LOW D . A taxonomy of obfuscating transformations [R ] . 1997 .

ANCKAERT B , MADOU M , DE SUTTER B , et al . Program obfuscation:quantitative approach [C ] // ACM Workshop on Quality of Protection , 2007 .

KIRK SR , JENKINS S . Information theory-based software metrics and obfuscation [J ] . Journal of Systems and Software , 2004 , 72 ( 2 ): 179 - 186 .

MOHSEN R , PINTO AM . Evaluating obfuscation security:A quantitative approach [C ] // International Symposium on Foundations and Practice of Security . 2016 .

MOHSEN R . Quantitative measures for code obfuscation security [D ] . London:Imperial College London , 2016 .

RODRÍGUEZ-VELIZ M , NUÑEZ-MUSA Y , LIMA R S . Call graph obfuscation and diversification:an approach [J ] . IET Inf Secur , 2020 , 14 ( 2 ): 241 - 252 .

TSAI HY , HUANG YL , WAGNER D . A graph approach to quantitative analysis of control-flow obfuscating transformations [J ] . IEEE Transactions on Information Forensics and Security , 2009 , 4 ( 2 ): 257 - 267 .

GAO D , REITER MK , SONG D . BinHunt:automatically finding semantic differences in binary programs [C ] // International Conference on Information and Communications Security . 2008 .

LUO L , MING J , WU D , et al . Semantics-based obfuscation-resilient binary code similarity comparison with applications to software plagiarism detection [C ] // ACM Sigsoft International Symposium on Foundations of Software Engineering . 2014 .

PUCELLA R , SCHNEIDER FB . Independence from obfuscation:a semantic framework for diversity [J ] . Computers ＆ Security , 2010 , 18 ( 5 ): 701 - 749 .

DALLA M , GIACOBAZZI R . Semantic-based code obfuscation by abstract interpretation [C ] // International Colloquium on Automata,Languages,and Programming . 2005 .

VITICCHIE A , REGANO L , TORCHIANO M , et al . Assessment of source code obfuscation techniques [C ] // International Working Conference on Source Code Analysis and Manipulation . 2016 .

CECCATO M , DI PENTA M , NAGRA J , et al . The effectiveness of source code obfuscation:an experimental assessment [C ] // International Conference on Program Comprehension . 2009 .

BANESCU S , COLLBERG C , GANESH V , et al . Code obfuscation against symbolic execution attacks [C ] // Annual Conference on Computer Security Applications . 2016 .

MAJUMDAR A , DRAPE S , THOMBORSON C . Metrics-based evaluation of slicing obfuscations [C ] // International Symposium on Information Assurance and Security . 2007 .

MOLNAR D , LI XC , WAGNER DA . Dynamic test generation to find integer bugs in x86 binary linux programs [C ] // USENIX Security Symposium . 2009 .

WANG Z , MING J , JIA C , GAO D . Linear obfuscation to combat symbolic execution [C ] // European Symposium on Research in Computer Security . 2011 .

ZUSE H . Software complexity:measures and methods [R ] . Berlin,Walter de Gruyter GmbH ＆ Co KG , 1991 .

KARNICK M , MACBRIDE J , MCGINNIS S , et al . A qualitative analysis of Java obfuscation [C ] // IASTED International Conference on Software Engineering and Applications . 2006 .

浏览量

403

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

DNNobfus：一种基于混淆的端侧模型保护框架技术研究

基于浮点数类型转换和运算的不透明谓词构造方法

模型学习与符号执行结合的安全协议代码分析技术

分支混淆中的条件异常代码构造研究

路径分支混淆研究综述