LOM: Lightweight Classifier for Obfuscation Methods

Kim, Jeongwoo; Kang, Seoyeon; Cho, Eun-Sun; Paik, Joon-Young

doi:10.1007/978-3-030-89432-0_1

Cited by 7 publications

(2 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It can construct general logical formulas representing the intrinsic characteristics of opaque predicates through the symbolic execution of trace, and use constraint solvers to solve these formulas to determine whether they contain opaque predicates. For obfuscated code classification, Kim et al [7] directly uses the histogram of the opcode to classify the obfuscation technology according to the frequency of different opcodes.…”

Section: Introductionmentioning

confidence: 99%

DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network

Tang¹,

Zheng²,

Zhang³

et al. 2022

Preprint

View full text Add to dashboard Cite

Obfuscation techniques have become complex and diverse, and while they play a crucial role in software copyright protection, they also help produce numerous malware variants that evade antivirus software. Automatic detection of malware is inseparable from binary code similarity detection technology. However, the existing code detection methods are difficult to cope with the increasingly complex obfuscation techniques. Therefore, in this paper, we propose a method combining data flow relationships and neural network to analyze obfuscated code for the first time. In our approach, we first construct the data transformation graph based on LLVM IR. Then, we design a novel intermediate language representation model based on graph neural network, named DFSGraph, to learn the data flow semantic from DTG. Through extensive experiments on obfuscated dataset, it is proved that our method can extract the semantic information of obfuscated code well. And it can achieve surprising results in binary code similarity detection task and obfuscation technique classification task. Our method provides an idea for further research on deobfuscation techniques.

show abstract

Section: Introductionmentioning

confidence: 99%

DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network

Tang¹,

Zheng²,

Zhang³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…It can construct general logical formulas representing the intrinsic characteristics of opaque predicates through the symbolic execution of trace, and use constraint solvers to solve these formulas to determine whether they contain opaque predicates. For obfuscated code classification, Kim et al [9] directly used the histogram of the opcode to classify the obfuscation technology according to the frequency of different opcodes.…”

Section: Introductionmentioning

confidence: 99%

DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network

Tang¹,

Shan²,

Zhang³

et al. 2022

Electronics

View full text Add to dashboard Cite

With the improvement of software copyright protection awareness, code obfuscation technology plays a crucial role in protecting key code segments. As the obfuscation technology becomes more and more complex and diverse, it has spawned a large number of malware variants, which make it easy to evade the detection of anti-virus software. Malicious code detection mainly depends on binary code similarity analysis. However, the existing software analysis technologies are difficult to deal with the growing complex obfuscation technologies. To solve this problem, this paper proposes a new obfuscation-resilient program analysis method, which is based on the data flow transformation relationship of the intermediate representation and the graph network model. In our approach, we first construct the data transformation graph based on LLVM IR. Then, we design a novel intermediate language representation model based on graph networks, named DFSGraph, to learn the data flow semantics from DTG. DFSGraph can detect the similarity of obfuscated code by extracting the semantic information of program data flow without deobfuscation. Extensive experiments prove that our approach is more accurate than existing deobfuscation tools when searching for similar functions from obfuscated code.

show abstract