maisМоделирование и анализ информационных системModeling and Analysis of Information Systems1818-10152313-5417Yaroslavl State University10.18255/1818-1015-2019-3-317-331mais-1226Research ArticleSoftwareОб автоматическом анализе практической стойкости обфусцирующих преобразованийOn the Automatic Analysis of the Practical Resistance of Obfusting Transformationshttps://orcid.org/0000-0002-8919-8310БорисовПетр ДмитриевичBorisovPetr D.

аспирант

graduate student

borisovpetr@mail.ruhttps://orcid.org/0000-0002-1491-524XКосолаповЮрий ВладимировичKosolapovYu. V.

канд. техн. наук

PhD

itaim@mail.ruЮжный Федеральный УниверситетРоссияSouthern Federal UniversityRussian Federation201928092019263317331Copyright © Борисов П.Д., Косолапов Ю.В., 20192019Борисов П.Д., Косолапов Ю.В.Borisov P.D., Kosolapov Y.V.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://www.mais-journal.ru/jour/article/view/1226

Разрабатывается способ оценки практической стойкости обфусцирующих преобразований программ, основанный на вычислении показателя похожести для исходной, обфусцированной и деобфусцированной программ. Предлагаются кандидаты для показателей похожести, в основе вычисления которых лежат такие характеристики программ, как граф потока управления, время символьного выполнения и степень покрытия при символьном выполнении. Граф потока управления рассматривается как основа для построения других кандидатов для показателей похожести программ. На его основе предлагается новый кандидат для показателя похожести, при вычислении которого находится расстояние Хэмминга между матрицами смежности графов потока управления сравниваемых программ. Строится схема оценки (анализа) стойкости обфусцирующих преобразований, в соответствии с которой для исходной, обфусцированной и деобфусцированной программ вычисляются или находятся характеристики этих программ, которые сравниваются в соответствии с выбранной моделью сравнения. Разработанная схема, в частности, подходит для сравнения программ на основе показателей похожести. В работе разрабатывается и реализуется один из ключевых блоков построенной схемы – блок получения характеристик программ, скомпилированных для архитектуры x86/x86_64. Разработанный блок позволяет находить граф потока управления, время символьного выполнения и степень покрытия при символьном выполнении. Приводятся некоторые результаты работы построенного блока.

 

A method is developed for assessing the practical persistence of obfuscating transformations of programs based on the calculation of the similarity index for the original, obfuscated and deobfuscated programs. Candidates are proposed for similarity indices, which are based on such program characteristics as the control flow graph, symbolic execution time and degree of coverage for symbolic execution. The control flow graph is considered as the basis for building other candidates for program similarity indicators. On its basis, a new candidate is proposed for the similarity index, which, when calculated, finds the Hamming distance between the adjacency matrices of control flow graphs of compared programs. A scheme for estimating (analyzing) the persistence of obfuscating transformations is constructed, according to which for the original, obfuscated and deobfuscated programs, the characteristics of these programs are calculated and compared in accordance with the chosen comparison model. The developed scheme, in particular, is suitable for comparing programs based on similarity indices. This paper develops and implements one of the key units of the constructed scheme - a block for obtaining program characteristics compiled for the x86/x86 64 architecture. The developed unit allow to find the control flow graph, the time for symbolic execution and the degree of coverage for symbolic execution. Some results of work of the constructed block are given.

обфускация кодастойкостьсимвольное исполнениеcode obfuscationresistancesymbolic executionReferencesSiegmund J., “Program Comprehension: Past, Present, and Future”, IEEE 23rd International Conference on Software Analysis, Evolution, and Reengineering (SANER), 5 (2016), 13–20.Siegmund J., “Program Comprehension: Past, Present, and Future”, IEEE 23rd International Conference on Software Analysis, Evolution, and Reengineering (SANER), 5 (2016), 13–20.Avidan E., Feitelson D. G., “From Obfuscation to Comprehension”, Proceedings of the 2015 IEEE 23rd International Conference on Program Comprehension, 2015, 178–181.Avidan E., Feitelson D. G., “From Obfuscation to Comprehension”, Proceedings of the 2015 IEEE 23rd International Conference on Program Comprehension, 2015, 178–181.Поздеев А. Г., Кривопалов В. Н., Ромашкин Е. В., Радченко Е. Д., “Математические и программные средства обфускации программ”, ПДМ, 1 (2009), 52–53;Pozdeev A. G., Krivopalov V. N., Romashkin E. V., Radchenko E. D., “Matematicheskie i programmnye sredstva obfuskacii programm”, PDM, 1 (2009), 52–53, (in Russian).Чернов А. В., “Анализ запутывающих преобразований программ”, 2002, http://www.citforum.ru/security/articles/analysis/;Chernov A. V., “Analiz zaputyvayushchih preobrazovanij programm”, 2002, http://www.citforum.ru/ security/articles/analysis/, (in Russian).Kuzurin N., Shokurov A., Varnovsky N., Zakharov V., “On the Concept of Software Obfuscation in Computer Security”, International Conference on Information Security. – Springer, Berlin, Heidelberg, 2007, 281–298.Kuzurin N., Shokurov A., Varnovsky N., Zakharov V., “On the Concept of Software Obfuscation in Computer Security”, International Conference on Information Security. – Springer, Berlin, Heidelberg, 2007, 281–298.Diffie W., Hellman M., “New directions in cryptography”, IEEE Transactions on Information Theory, 22:6 (1976), 644–654.Diffie W., Hellman M., “New directions in cryptography”, IEEE Transactions on Information Theory, 22:6 (1976), 644–654.Collberg C. S., Thomborson C., “Watermarking, Tamper-Proofing, and Obfuscation Tools for Software Protection”, IEEE transactions on software engineering, 28:8 (2002), 735– 746.Collberg C. S., Thomborson C., “Watermarking, Tamper-Proofing, and Obfuscation Tools for Software Protection”, IEEE transactions on software engineering, 28:8 (2002), 735– 746.Lee B., Kim Y., Kim J., “binOb+: a Framework for Potent and Stealthy Binary Obfuscation”, Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security, ASIACCS 2010, 2010, 271–281.Lee B., Kim Y., Kim J., “binOb+: a Framework for Potent and Stealthy Binary Obfuscation”, Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security, ASIACCS 2010, 2010, 271–281.Borello J.M., Me L., “Code Obfuscation Techniques for Metamorphic Viruses”, Journal in Computer Virology, 4:3 (2008), 211–220.Borello J.M., Me L., “Code Obfuscation Techniques for Metamorphic Viruses”, Journal in Computer Virology, 4:3 (2008), 211–220.Moser A., Kruegel C., Kirda E., “Limits of Static Analysis for Malware Detection”, Proceedings of Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007), 2007, 421–430.Moser A., Kruegel C., Kirda E., “Limits of Static Analysis for Malware Detection”, Proceedings of Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007), 2007, 421–430.Baiardi F., Sgandurra D., “An obfuscation-based approach against injection attacks”, Proceedings of the Sixth International Conference on Availability, Reliability and Security (ARES), 2011, 51–58.Baiardi F., Sgandurra D., “An obfuscation-based approach against injection attacks”, Proceedings of the Sixth International Conference on Availability, Reliability and Security (ARES), 2011, 51–58.Нурмухаметов А. Р., “Применение диверсифицирующих и обфусцирующих преобразований для изменения сигнатуры программного кода”, Труды ИСП РАН, 28:5 (2016), 93–104;Nurmukhametov A. R., “Primenenie diversificiruyushchih i obfusciruyushchih preobrazovanij dlya izmeneniya signatury programmnogo koda”, Trudy ISP RAN, 28:5 (2016), 93–104, (in Russian).Косолапов Ю. В., “Об обнаружении атак типа повторного использования исполнимого кода”, Моделирование и анализ информационных систем, 26:2 (2019), 213–228;Kosolapov Y. V., “About Detection of Code Reuse Attacks”, Modeling and Analysis of Information Systems, 26:2 (2019), 213–228, (in Russian).Collberg C., Thomborson C., Low D., “A taxonomy of obfuscating transformations”, Technical Report 148, The University of Auckland, New Zealand, 1997.Collberg C., Thomborson C., Low D., “A taxonomy of obfuscating transformations”, Technical Report 148, The University of Auckland, New Zealand, 1997.Walenstein A., El-Ramly M., Cordy J. R., Evans W. S., Mahdavi K., Pizka M., Ramalingam G., von Gudenberg J. W., “Similarity in Programs”, Duplication, Redundancy, and Similarity in Software, 2007, 1–8.Walenstein A., El-Ramly M., Cordy J. R., Evans W. S., Mahdavi K., Pizka M., Ramalingam G., von Gudenberg J. W., “Similarity in Programs”, Duplication, Redundancy, and Similarity in Software, 2007, 1–8.Chipounov V., Kuznetsov V., Candea G., “The S2E Platform: Design, Implementation, and Applications”, ACM Transactions on Computer Systems, 30:1 (2012), 1–49.Chipounov V., Kuznetsov V., Candea G., “The S2E Platform: Design, Implementation, and Applications”, ACM Transactions on Computer Systems, 30:1 (2012), 1–49.Saudel F., Salwan J., “Triton: A Dynamic Symbolic Execution Framework”, Symposium Sur La Security Des Technologies de L’information et Des Communications, SSTIC, 2015, 31–54.Saudel F., Salwan J., “Triton: A Dynamic Symbolic Execution Framework”, Symposium Sur La Security Des Technologies de L’information et Des Communications, SSTIC, 2015, 31–54.Wang Z, Ming J., Jia C., Gao D., “Linear Obfuscation to Combat Symbolic Execution”, Proceedings of Computer Security - ESORICS 2011, 6879 (2011), 210–226.Wang Z, Ming J., Jia C., Gao D., “Linear Obfuscation to Combat Symbolic Execution”, Proceedings of Computer Security - ESORICS 2011, 6879 (2011), 210–226.Brumley D., Hartwig C., Liang Z., Newsome J., Song D., Yin H., “Automatically Identifying Trigger-based Behavior in Malware”, Botnet Detection. Advances in Information Security, 36 (2008), 65–88.Brumley D., Hartwig C., Liang Z., Newsome J., Song D., Yin H., “Automatically Identifying Trigger-based Behavior in Malware”, Botnet Detection. Advances in Information Security, 36 (2008), 65–88.King J. C., “Symbolic execution and program testing”, Communications of the ACM, 19:7 (1976), 385–394.King J. C., “Symbolic execution and program testing”, Communications of the ACM, 19:7 (1976), 385–394.Cadar C., Dunbar D., Engler D. R., “KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs”, 8th USENIX Symposium on Operating Systems Design and Implementation, 8 (2008), 209–224.Cadar C., Dunbar D., Engler D. R., “KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs”, 8th USENIX Symposium on Operating Systems Design and Implementation, 8 (2008), 209–224.Shoshitaishvili Y.et al., “SoK: (State of) The Art of War: Offensive Techniques in Binary Analysis”, IEEE Symposium on Security and Privacy, 2016, 138–157.Shoshitaishvili Y.et al., “SoK: (State of) The Art of War: Offensive Techniques in Binary Analysis”, IEEE Symposium on Security and Privacy, 2016, 138–157.Sharif M. I., Lanzi A., Giffin J. T., Lee W., “Impeding Malware Analysis Using Conditional Code Obfuscation”, Proceedings of NDSS, 2008, 1–13.Sharif M. I., Lanzi A., Giffin J. T., Lee W., “Impeding Malware Analysis Using Conditional Code Obfuscation”, Proceedings of NDSS, 2008, 1–13.Udupa S. K., Debray S. K., Madou M., “Deobfuscation: Reverse Engineering Obfuscated Code”, Proceedings of the 12th Working Conference on Reverse Engineering (WCRE’05), 2005, 44–53.Udupa S. K., Debray S. K., Madou M., “Deobfuscation: Reverse Engineering Obfuscated Code”, Proceedings of the 12th Working Conference on Reverse Engineering (WCRE’05), 2005, 44–53.Nagarajan V., Gupta R., Zhang X., Madou M., De Sutter B., “Matching Control Flow of Program Versions”, IEEE International Conference on Software Maintenance, 2007, 84–93.Nagarajan V., Gupta R., Zhang X., Madou M., De Sutter B., “Matching Control Flow of Program Versions”, IEEE International Conference on Software Maintenance, 2007, 84–93.Bonfante G., Kaczmarek M., Marion J.Y., “Control Flow Graphs as Malware Signatures”, International Workshop on the Theory of Computer Viruses, 2007, 1–6.Bonfante G., Kaczmarek M., Marion J.Y., “Control Flow Graphs as Malware Signatures”, International Workshop on the Theory of Computer Viruses, 2007, 1–6.Park Y., Reeves D., Mulukutla V., Sundaravel B., “Fast Malware Classification by Automated Behavioral Graph Matching”, Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research, 2010, 1–4.Park Y., Reeves D., Mulukutla V., Sundaravel B., “Fast Malware Classification by Automated Behavioral Graph Matching”, Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research, 2010, 1–4.Kinable J., Kostakis O., “Malware classification based on call graph clustering”, Journal in Computer Virology, 7:4 (2011), 233–245.Kinable J., Kostakis O., “Malware classification based on call graph clustering”, Journal in Computer Virology, 7:4 (2011), 233–245.Lim H.I., “Comparing Control Flow Graphs of Binary Programs through Match Propagation”, IEEE 38th Annual Computer Software and Applications Conference, 2014, 598–599.Lim H.I., “Comparing Control Flow Graphs of Binary Programs through Match Propagation”, IEEE 38th Annual Computer Software and Applications Conference, 2014, 598–599.Dullien T., Rolles R., “Graph-based comparison of executable objects”, 5:1 (2005), 1–8.Dullien T., Rolles R., “Graph-based comparison of executable objects”, 5:1 (2005), 1–8.Chan P.P.F., Collberg C., “A Method to Evaluate CFG Comparison Algorithms”, 14th International Conference on Quality Software, 2014, 95–104.Chan P.P.F., Collberg C., “A Method to Evaluate CFG Comparison Algorithms”, 14th International Conference on Quality Software, 2014, 95–104.Axenovich M., Kezdy A., Martin R., “On the editing distance of graphs”, J. Graph Theory, 58:2 (2008), 123–138.Axenovich M., Kezdy A., Martin R., “On the editing distance of graphs”, J. Graph Theory, 58:2 (2008), 123–138.Борисов П. Д., Косолапов Ю. В., “О выборе характеристик для оценки стойкости обфусцирующих преобразований”, Современные информационные технологии: тенденции и перспективы развития. Труды XXVI научной конференции СИТО-2019., 2019, 42–44;Borisov P. D., Kosolapov Y. V., “O vybore harakteristik dlja ocenki stojkosti obfuscirujushhih preobrazovanij”, Sovremennye informacionnye tekhnologii: tendencii i perspektivy razvitiya. Trudy XXV nauchnoj konferencii SITO-2019., 2019, 42–44, (in Russian).Lehman M. M., Belady L. A. Program Evolution. Processes of Software Change., Academic press, 1985.Lehman M. M., Belady L. A. Program Evolution. Processes of Software Change., Academic press, 1985.Schnappinger M., Osman M. H., Pretschner A., Pizka M., Fietzke A., “Software Quality Assessment in Practice: a Hypothesis-Driven Framework”, Proceedings of the 12th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement, 2018, 1–6.Schnappinger M., Osman M. H., Pretschner A., Pizka M., Fietzke A., “Software Quality Assessment in Practice: a Hypothesis-Driven Framework”, Proceedings of the 12th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement, 2018, 1–6.Борисов П. Д., Косолапов Ю. В., “Модель экспериментального анализа стойкости алгоритмов обфускации”, Современные информационные технологии: тенденции и перспективы развития. Труды XXV научной конференции СИТО-2018., 2018, 37–39;Borisov P. D., Kosolapov Y. V., “Model’ eksperimental’nogo analiza stojkosti algoritmov obfuskacii”, Sovremennye informacionnye tekhnologii: tendencii i perspektivy razvitiya. Trudy XXV nauchnoj konferencii SITO-2018., 2018, 37–39, (in Russian).“IDA Pro”, https://www.hex-rays.com/products/ida/.“IDA Pro”, https://www.hex-rays.com/products/ida/.“The LLVM Compiler Infrastructure”, https://llvm.org/.“The LLVM Compiler Infrastructure”, https://llvm.org/.“McSema”, https://github.com/trailofbits/mcsema.“McSema”, https://github.com/trailofbits/mcsema.Junod P., Rinaldini J., Wehrli J., Michieliny J., “Obfuscator-LLVM – Software Protection for the Masses”, Conference: 2015 IEEE/ACM 1st International Workshop on Software Protection (SPRO), 2015, 3–9.Junod P., Rinaldini J., Wehrli J., Michieliny J., “Obfuscator-LLVM – Software Protection for the Masses”, Conference: 2015 IEEE/ACM 1st International Workshop on Software Protection (SPRO), 2015, 3–9.

The authors declare that there are no conflicts of interest present.