Software Birthmark Research Articles

Malware Detection Using Hidden Markov Model

Malware is a broad term for harmful software that poses significant threats by damaging computer systems and spreading across networks. Traditional detection methods include signature-based and heuristic-based techniques, which are effective against known malware but struggle with new, unknown variants, particularly sophisticated ones like metamorphic, encrypted, and polymorphic viruses. Hence, this research aims at improving malware detection, specifically targeting metamorphic malware that can evade traditional detection methods. The study shows the effectiveness of dynamic analysis over static analysis for detecting metamorphic malware due to its ability to adapt to the malware's constant changes. The dynamic analysis involves examining malware behavior during execution, using dynamic software birthmarks and the Hidden Markov Model to identify malicious activities. It therefore recommends the use of dynamic analysis in the detection of patterns of metamorphic malware. Keywords: Hidden markov models, Malware detection, Dynamic analysis and Static analysis

Software Birthmark Usability for Source Code Transformation Using Machine Learning Algorithms

Source code transformation is a way in which source code of a program is transformed by observing any operation for generating another or nearly the same program. This is mostly performed in situations of piracy where the pirates want the ownership of the software program. Various approaches are being practiced for source code transformation and code obfuscation. Researchers tried to overcome the issue of modifying the source code and prevent it from the people who want to change the source code. Among the existing approaches, software birthmark was one of the approaches developed with the aim to detect software piracy that exists in the software. Various features are extracted from software which are collectively termed as “software birthmark.” Based on these extracted features, the piracy that exists in the software can be detected. Birthmarks are considered to insist on the source code and executable of certain programming languages. The usability of software birthmark can protect software by any modification or changes and ultimately preserve the ownership of software. The proposed study has used machine learning algorithms for classification of the usability of existing software birthmarks in terms of source code transformation. The K-nearest neighbors (K-NN) algorithm was used for classification of the software birthmarks. For cross-validation, the algorithms of decision rules, decomposition tree, and LTF-C were used. The experimental results show the effectiveness of the proposed research.

Version-Wide Software Birthmark via Machine Learning

Identifying the credibility of executable files is critical for the security of an operating system. Modern operating systems rely on code signing, which uses a default-valid trust model, for executable files to identify their publishers. A malware could pass software validation of operating systems and security software by using counterfeit code-signing certificates. Although the counterfeit certificates can be revoked by CAs, the previous research showed that the revocation delay takes as long as 5.6 months. In this paper, we attempt to identify the credibility of software with multiple-version executable files without relying on public key infrastructure (PKI), where a new-version executable file is usually developed incrementally based on the previous versions. The sharing features among different versions can be extracted for identifying the software. Accordingly, we present a software-birthmark scheme to serve our purpose. Our scheme generates a cross-version software birthmark for executable files of the same software. The proposed software birthmark is a binary-classification model of a machine learning algorithm based on imported and exported function names extracted from different-version executable files. To evaluate the performance of version-wide software birthmarks, our experiments include 138 versions of Windows kernel32.dll and 545 versions of firefox.exe . We also use multiple machine learning algorithms for performance comparisons. The results show that proposed software birthmark can effectively identify the derivations of these executable files. The proposed software birthmark can be used by operating systems or security software to evaluate the credibility of executable files with suspicious certificates.

Modelling Features-Based Birthmarks for Security of End-to-End Communication System

Feature-based software birthmark is an essential property of software that can be used for the detection of software theft and many other purposes like to assess the security in end-to-end communication systems. Research on feature-based software birthmark shows that using the feature-based software birthmark joint with the practice of software birthmark estimation together can deliver a right and influential method for detecting software piracy and the amount of piracy done by a software. This can also guide developers in improving security of end-to-end communication system. Modern day software industry and systems are in demand to have an unbiased method for comparing the features-based birthmark of software competently, and more concretely for the detecting software piracy and assessing the security of end-to-end communication systems. In this paper, we proposed a mathematical model, which is based on a differential system, to present feature-based software birthmark. The model presented in this paper provides an exclusive way for the features-based birthmark of software and then can be used for comparing birthmark and assessing security of end-to-end communication systems. The results of this method show that the proposed model is efficient in terms of effectiveness and correctness for the features-based software birthmark comparison and security assessment purposes.

Graphs Resemblance based Software Birthmarks through Data Mining for Piracy Control

The emergence of software artifacts greatly emphasizes the need for protecting intellectual property rights (IPR) hampered by software piracy requiring effective measures for software piracy control. Software birthmarking targets to counter ownership theft of software by identifying similarity of their origins. A novice birthmarking approach has been proposed in this paper that is based on hybrid of text-mining and graph-mining techniques. The code elements of a program and their relations with other elements have been identified through their properties (i.e., code constructs) and transformed into Graph Manipulation Language (GML). The software birthmarks generated by exploiting the graph theoretic properties (through clustering coefficient) are used for the classifications of similarity or dissimilarity of two programs. The proposed technique has been evaluated over metrics of credibility, resilience, method theft, modified code detection and self-copy detection for programs asserting the effectiveness of proposed approach against software ownership theft. The comparative analysis of proposed approach with contemporary ones shows better results for having properties and relations of program nodes and for employing dynamic techniques of graph mining without adding any overhead (such as increased program size and processing cost).

A Kind of Static Software Birthmark Based on Control Flow

In traditional static k-gram birthmark algorithm, the result of plagiarism detection is inaccurate. It is a new method for plagiarism detection that using the software birthmark based on program control flow in this paper. First, it is used to the result of static that analysis of the Java program as meta information, analyze meta information to get byte stream instruction in method. Then, a byte instruction stream in the method to get the control flow structure of the program has been analyzed, and replaced the external references with external control flow structures, using this control flow structure as a software birthmark. Finally, it is calculated that the similarity between two birthmarks by VF2 algorithm, thus determining whether there is plagiarism between the two programs. It is shows that birthmark which presented in this paper are more credible than traditional SKB birthmarks in experimental results.

Birthmark based identification of software piracy using Haar wavelet

Piracy of software is an increasing problem of modern day software industry. Piracy of software is the unlawful use of software or part of it without proper permission as described in license agreement. Software piracy is a serious crime but not taken seriously by most people. Preventing software piracy is very important for the growing software industry. Efforts are being made to prevent and detect software piracy. Several techniques have been developed most important of which is software birthmark. The birthmark of a software is the intrinsic properties of software. A recent research shows that a features based software birthmark can be used as a strong mechanism to detect piracy of a software and how much piracy performed has been performed on it. An objective measure is needed to overcome this problem and to compare features based birthmark of a software which efficiently and precisely detect piracy in reproduction of software. The proposed study presents Haar wavelet collocation method for software features (birthmark) to detect piracy. The proposed method gives an exclusive solution for the features based birthmark of software and is then further used for comparisons of birthmark. The results of the proposed study show the effectiveness in terms of accuracy and efficiency to compare the features based software.

Software Birthmark Design and Estimation: A Systematic Literature Review

The concept of software birthmark is developed for the detection of theft and piracy in software applications. The originality of software can be evaluated by comparing software programs on the basis of their birthmarks. A number of birthmark designs have been proposed which are used to specify birthmark for source code and executable code related to particular programming languages. This study presents a systematic literature review on available software birthmark designs and related techniques for comparing birthmarks in order to identify pirated software. This research is focused on identifying different applications of software birthmark, especially the estimation of software birthmark to identify the extent of piracy performed in a software. The objective is to gain insight into complex details of software birthmark by accumulating and analyzing the knowledge provided in the literature in order to facilitate further research in software birthmark and its applications. The study is conducted by following the systematic literature review protocol. The data are collected from primary studies published from 1992 to April 2018 in specified journals and conference/workshop proceedings. A total of 143 primary studies are selected, based on predefined exclusion, inclusion, and quality criteria. The research identifies 22 software birthmark techniques frequently used and discussed by researchers and industry. The study also identifies a number of important applications of software birthmarks. These applications define the use of software birthmark in software theft and plagiarism detection, intellectual software asset management, detecting binary theft, malware detection, detecting the theft of natural language, and semantics-based repackaging detection for mobile apps. The results show that despite the large-scale research and development of different birthmark techniques, there is a lack of organized knowledge which is needed to facilitate the usage of software birthmark for critical applications like clone detection and malware detection. Furthermore, it is seen that the area of software birthmark estimation is not well researched which needs to be explored further. The study recommends that the area of software birthmark needs to be explored for developing a reliable and authentic mechanism which can accurately and easily detect software theft and ultimately prevent the piracy of software.

Выявление характерных особенностей программ для борьбы с компьютерным пиратством на основе интеллектуального анализа графов

The emergence of software artifacts greatly emphasizes the need for protecting intellectual property rights (IPR) hampered by software piracy requiring effective measures for software piracy control. Software birthmarking targets to counter ownership theft of software by identifying similarity of their origins. A novice birthmarking approach has been proposed in this paper that is based on hybrid of text-mining and graph-mining techniques. The code elements of a program and their relations with other elements have been identified through their properties (i.e code constructs) and transformed into Graph Manipulation Language (GML). The software birthmarks generated by exploiting the graph theoretic properties (through clustering coefficient) are used for the classifications of similarity or dissimilarity of two programs. The proposed technique has been evaluated over metrics of credibility, resilience, method theft, modified code detection and self-copy detection for programs asserting the effectiveness of proposed approach against software ownership theft. The comparative analysis of proposed approach with contemporary ones shows better results for having properties and relations of program nodes and for employing dynamic techniques of graph mining without adding any overhead (such as increased program size and processing cost).

Выявление характерных особенностей программ для борьбы с компьютерным пиратством на основе интеллектуального анализа графов

The emergence of software artifacts greatly emphasizes the need for protecting intellectual property rights (IPR) hampered by software piracy requiring effective measures for software piracy control. Software birthmarking targets to counter ownership theft of software by identifying similarity of their origins. A novice birthmarking approach has been proposed in this paper that is based on hybrid of text-mining and graph-mining techniques. The code elements of a program and their relations with other elements have been identified through their properties (i.e code constructs) and transformed into Graph Manipulation Language (GML). The software birthmarks generated by exploiting the graph theoretic properties (through clustering coefficient) are used for the classifications of similarity or dissimilarity of two programs. The proposed technique has been evaluated over metrics of credibility, resilience, method theft, modified code detection and self-copy detection for programs asserting the effectiveness of proposed approach against software ownership theft. The comparative analysis of proposed approach with contemporary ones shows better results for having properties and relations of program nodes and for employing dynamic techniques of graph mining without adding any overhead (such as increased program size and processing cost).

Предисловие к специальному выпуску «Продвинутые компьютерные методы: от теории к практике»

This special issue contains selected papers that had been submitted to Proceedings of the Institute for System Programming of the Russian Academy of Sciences. Thirteen submissions from nine countries (England, Mexico, China, Uruguay, Spain, Pakistan, Cuba, Dominican Republic, and Russia) cover several important topics in rapidly expanding area of research and development related with Advanced Computing. Authors show a spectrum of approaches to solve complex problems such as: data-oriented scheduling, scientific workflows, cloud computing, evolutionary algorithms, content distribution networks, soft computing, parallel programming model for multicore machines, high performance computing, data mining, software birth-marking, anomaly detection, swarm robotics, neural networks, machine learning, security, secret-sharing schemes, heterogeneous distributed computing, and Internet of Things.

Improvement of the Dynamic Software Birthmark Process by Reducing the Time of the Extraction

It is a quite tough task to detect the stolen programs since there is a quite huge number of programs in the world. The dynamic software birthmarks were proposed to detect the suspects of plagiarisms based on the runtime behavior of the programs. The detection process with the dynamic birthmarks is composed of extraction, and comparison phases. However, the extraction phase spends much time because it requires to prepare the inputs for running the programs. Generally, preparing the inputs requires the understanding about the target programs. Hence, this paper tries to reduce the extraction time without the understanding the programs by using the unit tests. We evaluated the credibility and resilience of properties of the dynamic birthmarks extracted by the proposed method. As a result, the similarities were greater than 0.8 among the newest two versions of the same products. On the other hand, similarities between different projects were under 0.355.

A New Software Birthmark based on Weight Sequences of Dynamic Control Flow Graph for Plagiarism Detection

A New Software Birthmark based on Weight Sequences of Dynamic Control Flow Graph for Plagiarism Detection

Improvement of the Dynamic Software Birthmark Process by Reducing the Time of the Extraction

Improvement of the Dynamic Software Birthmark Process by Reducing the Time of the Extraction

Scaling Up Software Birthmarks Using Fuzzy Hashing

To detect the software theft, software birthmarks have been proposed. Software birthmark systems extract software birthmarks, which are native characteristics of software, from binary programs, and compare them by computing the similarity between birthmarks. This paper proposes a new procedure for scaling up the birthmark systems. While conventional birthmark systems are composed of the birthmark extraction phase and the birthmark comparison phase, the proposed method adds two new phases between extraction and comparison, namely, compression phase, which employs fuzzy hashing, and pre-comparison phase, which aims to increase distinction property of birthmarks. The proposed method enables us to reduce the required time in the comparison phase, so that it can be applied to detect software theft among many larger scale software products. From an experimental evaluation, the authors found that the proposed method significantly reduces the comparison time, and keeps the distinction performance, which is one of the important properties of the birthmark. Also, the preservation performance is acceptable when the threshold value is properly set.

Open Source Software Detection Using Function Parameter Based Software Birthmark

As more software companies widely use Open-Source Software (OSS), the risk of open-source license violation has grown increasingly high. Moreover, because the companies often receive software module from upstream suppliers in binary form, it is very hard to obtain the source code. Software distributed in binary form frequently includes third-party libraries without following their licenses. Therefore, it is necessary to develop a technique for detecting OSS or unlicensed third-party code in their software products at the binary level not source level. In this paper, we propose an efficient function parameter based software birthmark at the binary level and develop a scheme to detect OSS using the birthmark. The proposed birthmark is based on the attributes of function parameters such as the number, types, and order. These attributes represent an intrinsic property of a function and are resilient to compiler optimization too. The new birthmark makes use of type mapping of function parameters of each function. Our scheme first extracts the birthmarks from target binary files, and determines whether a binary file contains another binary (e.g., OSS component) by computing the similarity between the extracted birthmarks. We also present an OSS detection framework that can integrate various birthmarking schemes with similarity computation algorithms. Our framework selects an appropriate algorithm to measure software similarity depending on the binary file type of target executables. The framework provides semi-global alignment, local alignment, and sliding-window k-gram algorithms for efficient detection of an OSS component contained in a target executable. The efficiency and effectiveness of the proposed framework are demonstrated through extensive experimentation.

Estimation of software features based birthmark

Software birthmark is an important property of software that is successfully used to detect piracy and theft of software. Estimation of a birthmark provides critical information about the extent of piracy performed in a software. This information can then be used to decide over many important issues related with software theft and piracy, including legal and ethical considerations. Research shows that a software birthmark based on multiple software features provides a powerful and unique identity to software, hence more useful in theft detection. The estimation of this features based birthmark may provide even close detection and estimation of software piracy. This estimation process provides an objective measure to detect software theft and piracy efficiently and accurately. The research uses the concept of fuzzy logic for estimation, which has already proved its success in estimation of other birthmarks. The technique is tested for features based birthmark through a case study and the results support validity of the process. The details of the case study elaborate upon techniques and details of implementing software birthmark estimation process and show that the method is effective in terms of efficiency and accuracy for the estimation of features based software birthmark.

Birthmark-Based Software Classification Using Rough Sets

Software theft or piracy is a rapidly growing problem which includes copying, modifying, and misusing proprietary software opposed to the license agreement. Software birthmark is a property of software that has been used for the detection of software theft successfully. Two separate pieces of software can be compared to identify the similarity in code by using their birthmarks. Comparison of the birthmarks of the softwares in question tells us whether software is a duplicate copy of another software or not. Similarity in birthmarks of two computer programs indicates that they are same. Until now, classification of software as pirated or not pirated still becomes a challenging task. Therefore, in this paper we present the use of rough set theory, which is a mathematical approach to deal with vagueness and uncertainty in classification problems. The technique is validated through an empirical case study. Some experiments show that the techniques are successful in assessing the specified properties of the birthmark and thus providing a valid classification decision.

Statistics and recognition for software birthmark based on clustering analysis

ABSTRACTThe result of feature selection for software birthmark has a direct bearing on software recognition rate. In this paper, we apply constrained clustering to analyze the software features (SF). The within-class (homogeneous software) and between-class (heterogeneous software) distances of features are measured based on mutual information. Information gain functions and penalty functions are constructed using homogeneous and heterogeneous SF, respectively; and redundancy is measured with correlation coefficients. Then the software birthmark features with high class distinction and minimum redundancy are selected. The example of extracting and detecting framework of birthmark feature is also given. The algorithm is analyzed and compared with the similar algorithms, and it is shown the algorithm provide an effective approach for software birthmark selection and optimization.

API-Based Software Birthmarking Method Using Fuzzy Hashing

API-Based Software Birthmarking Method Using Fuzzy Hashing