Search Based Clustering for Protecting Software with Diversified Updates

Abstract

Reverse engineering is usually the stepping stone of a variety of attacks aiming at identifying sensitive information (keys, credentials, data, algorithms) or vulnerabilities and flaws for broader exploitation. Software applications are usually deployed as identical binary code installed on millions of computers, enabling an adversary to develop a generic reverse-engineering strategy that, if working on one code instance, could be applied to crack all the other instances. A solution to mitigate this problem is represented by Software Diversity, which aims at creating several structurally different (but functionally equivalent) binary code versions out of the same source code, so that even if a successful attack can be elaborated for one version, it should not work on a diversified version. In this paper, we address the problem of maximizing software diversity from a search-based optimization point of view. The program to protect is subject to a catalogue of transformations to generate many candidate versions. The problem of selecting the subset of most diversified versions to be deployed is formulated as an optimisation problem, that we tackle with different search heuristics. We show the applicability of this approach on some popular Android apps.

Analysis of Obfuscated Code with Program Slicing

“…They argued that there are some characteristics of the execution that are strictly correlated with the underlying logic of the code which are invariant after applying obfuscation. The search for the optimal obfuscation configuration has been done by Ceccato et al [34] in case of software diversity but using static metrics.…”

Exploring the Use of Genetic Algorithm Clustering for Mobile App Categorisation

“…However, GAC fails to surpass the quality of the hierarchical clustering solution at higher K values. To the best of our knowledge, our study is the first to explore the viability of GA-based clustering solutions for mobile app categorisation, and, more in general, few studies have investigated search-based clustering in SE research (e.g., [5,6,11,15]). This study shows the viability of search-based clustering solutions for SE tasks, and we hope can open further avenues for SBSE research.…”

“…http://clapp.afnan.ws/data/ 4 Modified GAMA code can be found here: https://github.com/afnan-s/gama5 The cluster centre is the arithmetic mean of all the points belonging to the cluster.…”