Abstract
A kind of dynamic opcode n-gram software birthmark is proposed in this paper based on Myles' software birthmark (in which static opcode n-gram set is regarded as the software birthmark). The dynamic opcode n-gram set is regarded as the software birthmark which is extracted from the dynamic executable instruction sequence of the program. And the new birthmark can not only keep the advantages of feature n-gram set based on static opcode, but also possesses high robustness to code compression, encryption, packing. The algorithm which is to evaluate the similarity of the birthmarks of two programs is improved employing the theory of Probability and Statistic. As a result, the time complexity of the improved algorithm decreases to 0(n) from O(n2), while the space complexity keeps unchanged. Finally, the validity of the scheme is proved by experiments.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
