A static API birthmark for Windows binary executables
A static API birthmark for Windows binary executables
复制标题
DOI：
10.1016/j.jss.2008.11.848
复制
发表时间：
2009-05
期刊：
影响因子：
--
通讯作者：
Seokwoo Choi;Heewan Park;Hyun-il Lim;Taisook Han
中科院分区：
文献类型：
--
作者：
Seokwoo Choi;Heewan Park;Hyun-il Lim;Taisook Han
软件胎记是从程序本身中提取出来的程序固有的特征。通过比较胎记，我们可以检测一个程序是否是另一个程序的副本。我们为 Windows 可执行文件提出了一个静态 API 胎记，它利用反汇编器静态识别的 API 调用集。通过比较 49 个 Windows 可执行文件，我们表明胎记可以区分相似的程序并检测副本。通过比较各种编译器生成的二进制文件，我们还证明了我们的胎记是有弹性的。我们将我们的胎记与以前的 Windows 动态胎记进行比较，以表明它更适合 GUI 应用程序。
A software birthmark is the inherent characteristics of a program extracted from the program itself. By comparing birthmarks, we can detect whether a program is a copy of another program or not. We propose a static API birthmark for Windows executables that utilizes sets of API calls identified by a disassembler statically. By comparing 49 Windows executables, we show that our birthmark can distinguish similar programs and detect copies. By comparing binaries generated by various compilers, we also demonstrate that our birthmark is resilient. We compare our birthmark with a previous Windows dynamic birthmark to show that it is more appropriate for GUI applications.