Sciweavers

Share
ASIAN
2007
Springer

A Static Birthmark of Binary Executables Based on API Call Structure

12 years 2 months ago
A Static Birthmark of Binary Executables Based on API Call Structure
Abstract. A software birthmark is a unique characteristic of a program that can be used as a software theft detection. In this paper we suggest and empirically evaluate a static birthmark of binary executables based on API call structure. The program properties employed in this birthmark are functions and standard API calls when the functions are executed. The API calls from a function includes the API calls explicitly found from the function and its descendants within limited depth in the call graph. To statically identify functions, call graphs and API calls, we utilizes IDAPro disassembler and its plug-ins. We define the similarity between two functions as the proportion of the number of all API calls to the number of the common API calls. The similarity between two programs is obtained by the maximum weight bipartite matching between two programs using the function similarity matrix. To show the credibility of the proposed techniques, we compare the same applications with differe...
Seokwoo Choi, Heewan Park, Hyun-il Lim, Taisook Ha
Added 07 Jun 2010
Updated 07 Jun 2010
Type Conference
Year 2007
Where ASIAN
Authors Seokwoo Choi, Heewan Park, Hyun-il Lim, Taisook Han
Comments (0)
books