Exploit dynamic data flows to protect software against semantic attacks

Abstract

Unauthorized code modification based on reverse engineering is a serious threat for software industry. Virtual machine based code obfuscation is emerging as a powerful technique for software protection. However, the current code obfuscation techniques are vulnerable under semantic attacks which use dynamic profiling to transform an obfuscated program to construct a simpler program that is functionally equivalent to the obfuscated program but easier to analyze. This paper presents DSA-VMP, a novel VM-based code obfuscation technique, to address the issue of semantic attacks. Our design goal is to exploit dynamic data flows to increase the diversity of the program behaviour. Doing so can reduce the effectiveness of dynamic profiling. Our approach using multiple bytecode handlers to interpret a single bytecode and hiding the logics that determine the program execution path (it is difficult for the attacker anticipate the program execution flow). These two techniques greatly increase the diversity of the program execution where the protected code regions exhibit a complex data flow across multiple runs, making it harder and more time consuming to trace the program execution through profiling. Our approach is evaluated using a set of real-world applications. Experimental results show that DSA-VMP can well protect software against semantic attacks at the cost of little extra runtime overhead when compared to two commercial VM-based code obfuscation tools.

Efficient Detection of Phishing Websites Using Multilayer Perceptron

“…The second category is semantic attacks, where the attackers collect the victim information through some websites or links that looks like trusted websites or to acquire his/her username, password, and credit card information [4]. Table 1 shows some types of semantic attacks and a brief description for them [5].…”

Invalidating Analysis Knowledge for Code Virtualization Protection Through Partition Diversity

“…Virtual IS (Instruction Set) is the kernel part of this system. The interpreter will been used to convert IS into native code of Virtual instruction interpretation according to the classical decode-dispatch method [18], using a set of handlers and a VMloop. In this system, VMloop is the execution engine to fetch and decode the bytecode instructions and dispatch handler to interpret the instructions.…”

Exploiting Code Diversity to Enhance Code Virtualization Protection

“…At the heart of this system are the virtual IS (Instruction Set) and the set of interpreters used to translate the IS to native code. Interpretation of virtual instructions follows the classical decode-dispatch approach [18], using a bundle of handlers and a VMloop. Here, the VMloop is the execution engine which fetches and decodes a bytecode instruction and then dispatches a handler to interpret instruction.…”