Empirical assessment of the code comprehension effort needed to attack programs protected with obfuscation

In the context of rapid digitalization, copyright protection for digital content and software is becoming particularly important. The increasing volume of information exchange, the development of online platforms and the growing number of digital products create new legal challenges related to the protection of intellectual property. The article examines the specifics of copyright regulation in the digital environment, analyzes the key provisions of civil legislation and legal protection mechanisms. Special attention is paid to the use of modern technologies – digital watermarks, metadata, blockchain registration and platforms for depositing works, which make it possible to increase the effectiveness of copyright protection. It is noted that there is a need to improve law enforcement practices and increase the level of legal literacy among developers, authors and users of digital content. It is concluded that effective copyright protection requires an integrated approach, including legal, technical and educational measures that ensure a balance between the interests of copyright holders and society as a whole.

The discovery of novel undertakings in the computer-related inventions (CRIs) has always been a major challenge especially in the Indian scenario where the safeguarding regime is claimed by the Patents Act of 1970, specifically, the Section 3(k). The natural ambiguity of the technical contribution of such inventions has resulted in different testing standards and has subsequently curtailed the coverage of the protection of digital technologies, software, and artificial intelligence inventions. To work in line with the emerging jurisprudential trends and the fast paced technological advancements, the Indian Patent Office released the Draft CRI Guidelines of 2025. The current paper is a critical review of the draft guidelines where the legal and procedural framework of identifying inventive steps in CRIs is intended to be clarified. It discusses the use of judicial precedent like the case of Ferid Allani v. Lava and Union of India and Ericsson, and examines the proposed structured examination system, which includes the seven stambhas, and the five-step test of innovative step. The study outlines the benefits of the new method and its drawbacks as compared to the 2025 draft to previous guidelines and global standards. Respecting the progressiveness of the draft, the study recognises that harmonisation and transparency require practice and training of the examiners. It also speculates on what this means to the policy of innovation, the availability of safeguarding that is given to startups, and the competitiveness of the Indian digital economy globally.

This research explores the integration of neural networks into software protection mechanisms, focusing on enhancing cryptographic robustness against unlicensed copying and unauthorized access. The primary purpose is to develop a robust method that combines obfuscation and encryption to protect software by binding its activation and operation to specific hardware and user data, thereby preventing unlicensed replication and disassembly. The approach involves generating a unique hash of hardware identifiers, training a neural network on a remote server to produce a bytecode sequence for a virtual machine, and using the network’s weights as an activation code. Key results show that optimal neural network configurations, particularly those with two dense layers and one LSTM layer, achieve 100% accuracy in mapping predefined inputs to specific bytecodes within an average training time of 11 seconds, while generating pseudorandom outputs for all other inputs. Statistical analysis of output distributions reveals high entropy, demonstrating resilience against statistical attacks. The proposed method offers a layered defense against common attack vectors and ensures persistent security throughout the software’s lifecycle.

International Protection of Copyright in Computer Software: A Comparative Study of the UK and Sri Lanka

Virtualization-based environments have become ubiquitous tools for software development, testing, and security analysis. However, their dual use by adversaries to analyze and evade detection has spurred the development of anti–virtual machine (anti-VM) techniques. This work presents the design, implementation, and evaluation of an Anti–Virtual Machine Converter that enforces execution exclusively on physical hosts. By integrating multilayered detection—CPUID interrogation, BIOS and registry analysis, and process enumeration—with a dynamic payload- binding mechanism implemented via Python stubs and PyInstaller packaging, the system achieves sub-millisecond detection latency, zero false positives on a diverse set of 50 physical machines, and negligible performance overhead (<9% increase in launch time). A user-friendly GUI built with Tkinter and ttkbootstrap provides transparent feedback. Extensive experiments across VMware Workstation, VirtualBox, and Hyper-V validate robustness against advanced cloaking tools. This paper details each component’s design, the evaluation methodology, comprehensive results, and discusses implications for malware evasion and software protection, concluding with avenues for future enhancement. Unlike previous studies that merely identify virtualization presence, our approach tightly integrates payload delivery control, ensuring executable logic is not just aware of, but governed by, host authenticity—blending detection and response in one secure pipeline.

The article addresses current issues of software protection against malicious code and the detection of its manifestations during development and operation. It notes that modern methods of software analysis, particularly static and dynamic analysis, have both advantages and significant limitations, including a high number of false positives, low efficiency against polymorphic threats, and high computational resource requirements. As an optimal solution, the use of hybrid analysis is proposed, which combines the strengths of different approaches to improve the accuracy of vulnerability detection and reduce the number of erroneous results. The work presents a mathematical model for vulnerability detection based on symbolic execution and combined code analysis, as well as developed algorithms for constructing a reduced program path graph, calculating distance metrics to potentially dangerous code sections, and implementing directed dynamic symbolic execution. The methodology of vulnerability warning classification involves dividing them into three categories: confirmed, unconfirmed, and requiring additional inspection. This approach significantly reduces the complexity of analysis, improves the reliability of results, and automates the process of detecting potentially dangerous code. Particular attention is given to the formalization of concepts related to constraints on program path execution, symbolic conditions, and safety predicates. The obtained results demonstrate the effectiveness of hybrid analysis when working with large-scale projects where both speed and accuracy in threat detection are critical. The capabilities of the modular architecture of the hybrid analysis tool are examined, ensuring flexibility in expanding functionality and integrating new methods. An analysis of key software vulnerability metrics is conducted, which can be used to assess software security. Directions for further research are proposed, particularly improving symbolic execution algorithms to account for indirect dependencies and anti-analysis mechanisms. The research findings can be applied in the development of new systems and the modernization of existing code analysis tools aimed at enhancing software security.

The automotive industry's transformation toward connected and software-defined vehicles has fundamentally altered the cybersecurity landscape, necessitating comprehensive security frameworks that address unprecedented threats while maintaining safety-critical system performance. This article examines the evolution of automotive cybersecurity from foundational technologies such as secure boot mechanisms, trusted execution environments, and hardware security modules to advanced network protection strategies that have transitioned from vulnerable Controller Area Network protocols to secure Automotive Ethernet implementations with sophisticated intrusion detection capabilities. The article explores Vehicle-to-Everything communication security frameworks, including cryptographic protocols for vehicle identity management, infrastructure authentication, and privacy-preserving vehicle-to-vehicle communications that enable secure connected mobility ecosystems. Over-the-air update security mechanisms are investigated through secure package development, digital signature implementation, and rollback protection systems that ensure software integrity throughout vehicle lifecycles. The critical balance between cybersecurity measures and real-time performance requirements is addressed through performance impact analysis and adaptive security mechanisms that maintain system responsiveness in safety-critical applications. Industry case studies demonstrate defense-in-depth implementation strategies employed by leading manufacturers, while regulatory compliance frameworks, including international standards and certification procedures, establish mandatory cybersecurity requirements for vehicle type approval. Emerging challenges from quantum computing and artificial intelligence present both opportunities for enhanced security capabilities and new threat vectors that require post-quantum cryptography implementation and secure machine learning systems. The article reveals that effective automotive cybersecurity requires integrated multi-layered approaches that combine hardware-based security foundations with advanced software protection mechanisms, continuous monitoring systems, and industry-wide collaboration to address evolving threats while preserving the safety, reliability, and user experience essential to modern connected vehicle deployment.

The article defines that cybersecurity of critical infrastructure in the context of digitalization is a set of measures, technologies and processes aimed at protecting systems, services and data that ensure the functioning of critical infrastructure facilities (energy, transport, water supply, telecommunications, etc.), in the context of their transition to digital platforms. Digitalization is understood as the gradual introduction of information and communication technologies (ICT), automated control systems (SCADA), IoT devices and cloud solutions to increase the efficiency, efficiency and scalability of management. At the same time, this transition opens up new vulnerabilities: each element of the network, from the controller of pumping stations to the sensor of a "smart" meter, becomes a potential access point for cybercriminals. Therefore, cybersecurity in this context encompasses both the protection of physical components (PLC controllers, servers, routers) and software (operating systems, SCADA applications), network protocols and data circulating within and between these systems. Taken together, technical and economic challenges form a complex context for ensuring cybersecurity of critical infrastructure during digitalization. They can only be solved through a multidisciplinary approach that combines state regulation (equipment and process certification requirements), the involvement of international standards (ISO/IEC 27001, IEC 62443), the stimulation of private investment (through partnerships with state infrastructure access fees) and the development of our own human capital through specialized educational programs and pilot routes for the integration of engineers. The subject of the article is the disclosure of economic tools for assessing risks and investments in the development of cybersecurity of critical infrastructure, which is caused by digitalization processes. Research methods. When studying economic tools for assessing risks and investments in the development of cybersecurity of critical infrastructure, which is caused by digitalization processes, classical research methods were used (dialectical materialism, abstraction, analysis and synthesis, functional, systems analysis, synergistic, comparative law, interpretation and hermeneutics, dogmatic and statistical methods). The purpose of the article is the disclosure of economic tools for assessing risks and investments in the development of cybersecurity of critical infrastructure, which is caused by digitalization processes. Conclusions. The development of cybersecurity of critical infrastructure in conditions of active digitalization requires the comprehensive application of economic tools for assessing risks and planning investments. The use of quantitative risk analysis methods, cost-benefit analysis estimates, and scenario modeling allows critical infrastructure entities to justify the amount of resources needed to implement protective technologies. Regression and economic-mathematical models allow you to project the scale of cyber threats and predict potential financial losses from incidents, while allowing you to compare the effectiveness of alternative options for measures - from upgrading legacy PLC controllers to implementing SIEM/IDS systems. Thanks to a multi-criteria approach and analysis of real options, business leaders can allocate the budget in such a way as to ensure the optimal balance between preventive investments in security and current operating costs, minimizing both direct and indirect losses from failures and reputational risks. At the same time, the success of a critical infrastructure cyber protection strategy largely depends on effective government regulation and international harmonization of standards. In particular, the implementation of the NIS 2 Directive and approximation to the provisions of the EU DORA stimulate the development of unified audit, monitoring and operational response procedures. Tax incentives, grant mechanisms for co-financing and cyber risk insurance can become an additional tool for economic incentives for CI operators to modernize their digital systems. The development of human capital is also of key importance: investments in the training of cybersecurity specialists, the establishment of cooperation between universities, industrial enterprises and international organizations will ensure the sustainability and adaptability of protective measures. As a result, such a synergy of economic instruments, the legal environment and human resources support will allow achieving a high level of resilience of critical infrastructure to cyber threats and ensuring the uninterrupted functioning of key industries in the face of any challenges of the digital world.

Abstract Code obfuscation is essential for software security. However, current obfuscation techniques demonstrate limited resilience against systematic reverse engineering attacks—including taint analysis and code similarity detection. Moreover, these methods often incur considerable resource overheads and recognizable obfuscation features. In this paper, we propose an innovative obfuscation algorithm that integrates the instruction and data flows of two programs at the intermediate representation level. The resulting program maintains the complete functionality of both original programs. This strategy utilizes the static and dynamic features of the parent program to obfuscate the target program. Extracting the target code from the integrated program is a significant challenge, thereby enhancing the target code’s resistance to deobfuscation. We evaluate our algorithm across various metrics: functionality correctness, obfuscation efficiency, protection strength, and resilience to automated reverse engineering techniques. Our comprehensive evaluation demonstrates that our method imposes significantly lower overhead while delivering markedly improved protection effectiveness, marking a significant advancement in software protection.

Software protection refers to a range of methods used to protect applications against reverse engineering. Although this term is commonly used, distinctions arise in the specific tools and techniques utilized, such as packers, protectors, and obfuscators, as each category employs different strategies to defend applications against analysis. Given the growing importance of protecting intellectual property and sensitive user information stored in mobile applications, these protective measures have become indispensable. This paper presents a taxonomy categorizing and describing the main techniques used to secure Android applications. Additionally, we analyze the available software tools designed to aid developers in protecting their applications, as well as their prevalence in the wild using a longitudinal dataset comprising nearly 2.5 million apps, including malicious software, pre-installed applications, and regular market application. Our key findings show that, although the use of software protection techniques has been steadily increasing over the last decade, they are still used only by a small fraction of applications in the Android ecosystem. Games and financial applications are by far the ones that most commonly use some form of protection, and we also observe noticeable differences between marketplaces.

<p>This article examines the legal protection boundaries of software within the intellectual property system, particularly focusing on the ambiguity between copyright and patent regimes. The main issue addressed is whether software with technical functions should be protected solely through patents or whether copyright is sufficient, considering the dual nature of software as both an expressive work and a technological tool. Using a normative legal approach, this study analyzes the national legal framework and compares it with other jurisdictions. The research findings indicate that dual protection without clear boundaries may lead to legal uncertainty, especially for software industry players who require clarity regarding their exclusive rights. Therefore, a more assertive and harmonized legal policy formulation is needed to ensure optimal protection of software in both its creative and functional aspects.</p>

The article considers a comprehensive approach to predicting the security index of local computer networks of organizations using modern econometric tools. The main attention is paid to the adaptation of classical production functions, in particular the Cobb–Douglas model, to the sphere of information security. The application of two modifications of the Cobb–Douglas production function — linear and nonlinear forms — is proposed to model the impact of key factors on the level of security of information infrastructure. The econometric models presented in the study take into account the impact of investments in cybersecurity, human capital, as well as technical and software protection tools used within organizational information systems. In particular, the following independent variables are included in the model: the amount of investment in security hardware (for example, firewalls, firewalls, routers with security functions), the cost of security software (intrusion detection and prevention systems, antivirus, SIEM), as well as parameters characterizing the human factor, in particular the number of information security specialists involved in the enterprise. The article provides a theoretical justification for the choice of the model, identifies the main endogenous and exogenous variables, analyzes their impact on the resulting variable, and also considers approaches to collecting, validating, and pre-processing empirical data. An econometric model was built based on real data collected from a number of organizations of various profiles, which made it possible to test the model in real conditions. The estimation of model parameters was carried out using multiple regression methods using the Statistica econometric analysis software. The modeling results confirmed the feasibility of using Cobb–Douglas functions in the field of cybersecurity and made it possible to combine the volumes of input data to model the future situation and determine the overall level of security of organizational networks. The conclusions obtained can be useful for forming an effective information security management policy, optimizing costs for cyber protection, as well as for strategic planning of investments in the development of information infrastructure. The proposed approach is flexible and scalable, which allows it to be adapted to the specifics of individual industries or organizations.

In the work, a study of the functioning of complex information systems is carried out, which is aimed at the analysis of existing protection methods, the development of the concept of the code transformation mechanism, which will ensure a high level of protection of .NET applications. The architecture of the .NET Framework with modern universal improvements is considered. One of the important elements is the Base Class Library (BCL), which is a set of base classes and libraries that provide standard functionality, such as working with files, networks, databases, text processing, and basic data structures. It was determined that obfuscation is one of the most common methods of software protection, which consists in modifying the source or intermediate code in such a way as to preserve its functionality, but make it difficult to understand. The main features of code improvement are established, which consist in obfuscating execution flows, encrypting string literals, and using packers and crypters. A characteristic feature of packers and crypters is direct injection into memory, which reflects its functionality in unpacking or decrypting program code directly into random access memory (RAM), which makes it difficult to remove a dump of the process. In addition, the entanglement of execution threads allows you to modify the logic of the software operation by inserting unnecessary conditions, loops or transitions, which creates complex execution structures. The anti-debugging process is proposed, which is one of the key components of software protection against reverse engineering. A conceptual approach to the implementation of software anti-debugging mechanisms is formed, which consists in multi-level protection of software and changes the instructions and behavior of the virtual machine. One of the important elements of such algorithms is checking parent processes and detecting debugging using hardware breakpoints. This, in its turn, opens up the possibility during the design of a virtual machine in combination with other techniques to create significant obstacles for the analysis of the software code.

As artificial intelligence (AI) systems become increasingly embedded in critical infrastructure such as energy, transportation, and healthcare, ensuring their security, privacy, and trustworthiness is essential. This study investigates the application of machine learning models to enhance the protection of AI software operating within these sensitive environments. The research specifically focuses on classifying malicious PortScan network activity using the Friday Afternoon Port Scan dataset from the NSL-KDD repository. A quantitative approach was adopted, employing two ensemble machine learning algorithms: Random Forest and Gradient Boosting. The dataset underwent preprocessing, including handling of missing and infinite values, feature selection, and multicollinearity checks using a correlation matrix and Variance Inflation Factor (VIF). Both models were tuned using GridSearchCV with five-fold cross-validation and evaluated using metrics such as accuracy, precision, recall, F1 score, and ROC-AUC. The results revealed that both models achieved perfect classification performance, with all evaluation metrics, including AUC, recording a score of 1.000. Confusion matrix analysis showed extremely low misclassification rates, with Random Forest slightly outperforming Gradient Boosting. Feature importance plots identified forward packet characteristics as dominant in decision-making. Despite these impressive outcomes, the study recognizes the possibility of overfitting and emphasizes the need for external validation using real-world traffic. Based on the findings, the study recommends embedding secure-by-design principles in AI development, enforcing robust data privacy controls, and ensuring transparency through explainable AI techniques. These practices are vital for maintaining public trust and operational integrity in AI-powered critical systems. Keywords: Artificial Intelligence, Critical Infrastructure, Security, Privacy, Machine Learning, Gradient Boosting, Intrusion Detection.

Computer software protection presents complex and interrelated challenges, particularly in copyright and patent law. Developing countries in the Asia-Pacific region, including Pakistan, struggle with inadequate legal frameworks to safeguard both national and international software, exacerbated by the rapid evolution of software-related products and services. In contrast, China has made substantial progress in strengthening software protection through comprehensive copyright laws, regulatory measures, and inter-ministerial coordination frameworks that promote the use of legitimate software. These initiatives have significantly improved China's software copyright protection system, fostering the growth of its software industry. Furthermore, China's Patent Examination Guidelines provide a structured approach to software patentability, distinguishing between conventional software, which lacks patent protection, and innovative software, which qualifies for such protection. Given these advancements, Pakistan can benefit from implementing well-defined legal and administrative measures to enhance software protection. This study examines China’s current software protection policies, legislative and administrative frameworks, and their applicability to Pakistan, offering insights into potential legal reforms to strengthen software protection in the country.

Legal regimes for computer programs and databases vary around the world, but share common principles for protecting intellectual property. Computer programs are primarily protected by copyright law, while patents for technical innovations are available in jurisdictions such as the US, EU and Japan. Databases may be protected by copyright for creative works and, in some regions, by additional sui generis rights (e.g. in the EU) or by laws specific databases (e.g. in Japan). Challenges include adapting to advances in artificial intelligence, big data and open source technologies, highlighting the need to evolve legal frameworks to ensure a balance between innovation and protection. In addition, in some jurisdictions, patent law provides protection for software that contains technical or functional innovations. Copyright law (Title 17 of the US Code) protects software, while patents apply to technical solutions. Licensing agreements and case law on fair use play an important role in ensuring compliance. The EU Copyright Directive harmonizes protection by limiting reverse engineering rights to ensure compatibility. Patent protection is granted if software demonstrates a technical effect. Databases, which include data sets, are protected differently in different jurisdictions depending on the originality or significant investment required. Copyright extends to databases created creatively, but the facts themselves are not protected. Licensing and contract law also ensure the use of databases. The Database Directive provides copyright for creative databases and a sui generis right protecting databases created as a result of significant effort, regardless of their originality.

In the digital era, software security is crucial to prevent financial losses and data theft due to cyber attacks such as Cross-Site Request Forgery (CSRF). Based on CVEdetails data, CSRF attacks increased significantly from 416 cases in 2020 to 1398 cases in 2023. This research explores the use of Static Application Security Testing (SAST) to detect and prevent CSRF attacks. In addition, anti-CSRF token and mutation testing are used to improve the quality of test cases in detecting CSRF vulnerabilities. The research results show that the mutation testing technique is effective in improving the quality of test cases, with the Mutation Score Index (MSI) value increasing from 50% to 100% after improvement. This research concludes that mutation testing can improve the quality of test cases, thereby providing better software protection against CSRF attacks.

Процеси інформатизації суспільства та його глобальна індустріалізація нерозривно пов'язані із стрімким розвитком комп’ютерних технологій та інтернет-індустрії. У матеріалах статті доведено, що така правова норма, як інтелектуальна власність у сфері IT-технологій стала найважливішим предметом правовідносин. У дослідженні використовували наступні методи: порівняльно-правовий (для аналізу норм законодавства України та країн ЄС), системний аналіз (для вивчення змісту нормативно-правових актів), узагальнення (для висновків), історичний метод (для аналізу розвитку бази законодавства). Комплексний підхід щодо використання цих методів сприяв реалізації всебічного вивчення матеріалів та сформував системне бачення щодо вирішення поставлених завдань. За результатами системного аналізу встановлено, що країни Північно-Західної Європи (Бельгя, Нідерланди та Люксембург) забезпечують надійну законодавчу підтримку для захисту авторських прав щодо програмного забезпечення, баз даних і різних веб-ресурсів. Системний аналіз українського законодавства засвідчив прагнення країни привести своє законодавство у відповідність із чинними європейськими директивами та нормами щодо інтелектуальної власності. Отже, вивчення досвіду західноєвропейських країн у цій сфері є важливим аспектом, оскільки їхні досягнення можуть запропонувати цінну інформацію для українських законодавців, які працюють за напрямом європейської інтеграції. Попередні дослідження, які пов’язані із захистом комп’ютерних програм та баз даних, додатково підтверджують актуальність цього питання та показують, що існує значний інтерес до цієї проблеми серед фахівців у сфері державного управління та авторського права. Законодавство України наразі адаптується до міжнародних стандартів та Директив ЄС. Враховуючи швидкий розвиток цифрових технологій, існує потреба у систематичному вдосконаленні національного законодавства. Виокремлено проблему кіберзлочинності в ІТ-секторі. Зазначено, що все більше країн зосереджують свою увагу на боротьбі з несанкціонованим використанням програмного забезпечення та комплексного захисту комп’ютерних програм і баз даних. Розробка законів, які регулюють обіг та захист персональних даних в мережі Інтернет, визначають відповідальність за порушення авторських і суміжних прав у цифровому середовищі є визначальною необхідністю сьогодення. Відмічено стрімкий розвиток технологій штучного інтелекту, який зумовлює необхідність перегляду законодавчих підходів до авторського права на твори, створені за його допомогою.

Exploiting modern software requires sophisticated attack vectors to bypass software protection mechanisms. Code-reuse Attacks (CRAs) are a widely used approach to attack modern software, even after applying memory protection defenses. The underlying vulnerabilities in the software codes or design enable the use of the program’s own code and manipulation of data and code. This paper covers the foundation of memory-based attacks and provides an extensive overview of memory safety issues and exploitation methods, as well as the foundation of control flow attacks and different categories of code-reuse attacks. The focus is on the differences between the various methods employed to mitigate code-reuse attacks. We apply an analysis technique to the covered CRAs to assist in the ranking and evaluation process. The chosen decision-making technique is SMAA-2, which is employed to analyze the mitigation defenses and techniques. This novel approach to evaluating CRAs mitigations helps Decision-makers (DM) in selecting specific CRA techniques over others.