A Static Birthmark of Binary Executables Based on API Call Structure

Abstract

Abstract.A software birthmark is a unique characteristic of a program that can be used as a software theft detection. In this paper we suggest and empirically evaluate a static birthmark of binary executables based on API call structure. The program properties employed in this birthmark are functions and standard API calls when the functions are executed. The API calls from a function includes the API calls explicitly found from the function and its descendants within limited depth in the call graph. To statically identify functions, call graphs and API calls, we utilizes IDAPro disassembler and its plug-ins. We define the similarity between two functions as the proportion of the number of all API calls to the number of the common API calls. The similarity between two programs is obtained by the maximum weight bipartite matching between two programs using the function similarity matrix. To show the credibility of the proposed techniques, we compare the same applications with different versions and the various types of applications which include text editors, picture viewers, multimedia players, P2P applications and ftp clients. To show the resilience, we compare binary executables compiled from various compilers. The empirical result shows that the similarities obtained using our birthmark sufficiently indicates the functional and structural similarities among programs.

Detecting code theft via a static instruction trace birthmark for Java methods

“…Choi et al suggested a static API birthmark for Windows [17]. Their static API birthmark is a set of possible API calls which is extracted statically by analyzing disassembled code.…”

A Survey of Feature Extraction Techniques to Detect the Theft of Windows Applications

“…Software birthmarks can be classified into static and dynamic birthmarks [2][3][4][5][6][7][8][9][10][11][12][13]. Static birthmarks rely on syntactic structure of a program, and are extracted from it without its execution.…”

“…Software birthmark is an intrinsic feature of a program that can be used to identify the program and prove software plagiarism [2,3,4,5,7,9,10,11,12,13,15]. A birthmark can detect software theft by comparing the native characteristics of programs.…”

“…Many research studies have been carried out on the topic to detect and stop illegal copying of software [2][3][4][5][6][7][8][9][10][11][12][13]. However, there is still lack of good techniques to control copyrighted software.…”

An Efficient Categorization of the Instructions Based on Binary Excutables for Dynamic Software Birthmark

“…In addition, compilers that create byte code such as JAVA can extract relatively more accurate static birthmark compared to binary execution file, but it is difficult to extract by accurately analyzing code since accurate distinction between code and data is not possible with binary execution file. That's why dynamic birthmark method has been studied to extract birthmark in executed state of program [5], [6], [8], [9].…”