Detecting Java Theft Based on Static API Trace Birthmark

Park, Heewan; Choi, Seokwoo; Lim, Hyeong-Seok; Han, Tian

doi:10.1007/978-3-540-89598-5_8

Cited by 22 publications

(19 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These algorithms compute the birthmark from the sequence of method calls within a class, the inheritance path from the root class to a given class, and the types that a class employs, respectively, [24], [25]. In addition, Park et al proposed a static API-call-based birthmark for software theft detection of Java applications [26]. Choi et al additionally presented a static API birthmark for Windows execution files using a set of API calls identified as being static by a disassembler [27].…”

Section: Api-based Birthmarksmentioning

confidence: 99%

API-Based Software Birthmarking Method Using Fuzzy Hashing

Lee

Kang

Choi

et al. 2016

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

Donghoon LEE†a) , Dongwoo KANG †b) , Younsung CHOI † †c) , Jiye KIM †d) , Nonmembers, and Dongho WON †e) , Member SUMMARY The software birthmarking technique has conventionally been studied in fields such as software piracy, code theft, and copyright infringement. The most recent API-based software birthmarking method (Han et al., 2014) extracts API call sequences in entire code sections of a program. Additionally, it is generated as a birthmark using a cryptographic hash function (MD5). It was reported that different application types can be categorized in a program through prefiltering based on DLL/API numbers/names. However, similarity cannot be measured owing to the cryptographic hash function, occurrence of false negatives, and it is difficult to functionally categorize applications using only DLL/API numbers/names. In this paper, we propose an API-based software birthmarking method using fuzzy hashing. For the native code of a program, our software birthmarking technique extracts API call sequences in the segmented procedures and then generates them using a fuzzy hash function. Unlike the conventional cryptographic hash function, the fuzzy hash is used for the similarity measurement of data. Our method using a fuzzy hash function achieved a high reduction ratio (about 41% on average) more than an original birthmark that is generated with only the API call sequences.In our experiments, when threshold ε is 0.35, the results show that our method is an effective birthmarking system to measure similarities of the software. Moreover, our correlation analysis with top 50 API call frequencies proves that it is difficult to functionally categorize applications using only DLL/API numbers/names. Compared to prior work, our method significantly improves the properties of resilience and credibility. key words: software birthmark, birthmarking systems, software similarity, fuzzy hash, API-based sequences

show abstract

Section: Api-based Birthmarksmentioning

confidence: 99%

API-Based Software Birthmarking Method Using Fuzzy Hashing

Lee

Kang

Choi

et al. 2016

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…Because the two approaches only consider the physical orders of instructions, they are susceptible to program modifications that change control flows of programs. Park et al presented methods for detecting software thefts by comparing the full traces of instructions [34] or API calls [33] of programs. These approaches can be applied only to small programs, because the number of traces may exponentially increase according to the program structures.…”

Section: Related Workmentioning

confidence: 99%

A method for detecting the theft of Java programs through analysis of the control flow information

Lim

Park

Choi

et al. 2009

Information and Software Technology

Self Cite

View full text Add to dashboard Cite

“…Thus, such approaches are susceptible to program transformations. Park et al [8] presented the API trace birthmark for Java programs that proceeds by constructing sets of static API traces, but the usage of this approach is limited to programs which use plentiful API calls.…”

Section: Related Work and Motivationmentioning

confidence: 99%

“…The numbers of total control flow edges ranged between 3,566 and 5,679, and the average numbers of control flow edges in a class file ranged between 84 and 127. For a comparative evaluation of the performance of the proposed birthmark, two previous approaches, the k-gram based [5], [6] and API Trace [8] birthmarks, were also evaluated.…”

Section: A Preliminariesmentioning

confidence: 99%

A Static Java Birthmark Based on Control Flow Edges

Lim

Park

Choi

et al. 2009

2009 33rd Annual IEEE International Computer Software and Applications Conference

Self Cite

View full text Add to dashboard Cite

Abstract-A software birthmark is an inherent characteristic of a program that can be used to identify that program. By comparing the birthmarks of two programs, it is possible to infer if one program is a copy of another. In this paper, we propose a static birthmark based on the control flow edges in Java programs. Control flow edges can represent possible behaviors in program execution. Thus, a set of the control flow edges of a program can be used as a birthmark for that program. The similarity between two programs can then be calculated by finding pairs of similar behaviors of the control flow edges in the two birthmarks. The proposed birthmark is evaluated and compared with previous approaches in terms of credibility and resilience. Experimental results show that the proposed birthmark is more reliable than previous methods for detecting programs that are suspected to be copied.

show abstract

Detecting Java Theft Based on Static API Trace Birthmark

Cited by 22 publications

References 11 publications

API-Based Software Birthmarking Method Using Fuzzy Hashing

API-Based Software Birthmarking Method Using Fuzzy Hashing

A method for detecting the theft of Java programs through analysis of the control flow information

A Static Java Birthmark Based on Control Flow Edges

Contact Info

Product

Resources

About