Program Characterization Using Runtime Values and Its Application to Software Plagiarism Detection

Yoon Chan Jhi, Xiaoqi Jia, Xinran Wang, Sencun Zhu, Peng Liu, Dinghao Wu

Research output: Contribution to journalArticlepeer-review

35 Scopus citations

Abstract

Illegal code reuse has become a serious threat to the software community. Identifying similar or identical code fragments becomes much more challenging in code theft cases where plagiarizers can use various automated code transformation or obfuscation techniques to hide stolen code from being detected. Previous works in this field are largely limited in that (i) most of them cannot handle advanced obfuscation techniques, and (ii) the methods based on source code analysis are not practical since the source code of suspicious programs typically cannot be obtained until strong evidences have been collected. Based on the observation that some critical runtime values of a program are hard to be replaced or eliminated by semantics-preserving transformation techniques, we introduce a novel approach to dynamic characterization of executable programs. Leveraging such invariant values, our technique is resilient to various control and data obfuscation techniques. We show how the values can be extracted and refined to expose the critical values and how we can apply this runtime property to help solve problems in software plagiarism detection. We have implemented a prototype with a dynamic taint analyzer atop a generic processor emulator. Our value-based plagiarism detection method (VaPD) uses the longest common subsequence based similarity measuring algorithms to check whether two code fragments belong to the same lineage. We evaluate our proposed method through a set of real-world automated obfuscators. Our experimental results show that the value-based method successfully discriminates 34 plagiarisms obfuscated by SandMark, plagiarisms heavily obfuscated by KlassMaster, programs obfuscated by Thicket, and executables obfuscated by Loco/Diablo.

Original languageEnglish (US)
Article number7076635
Pages (from-to)925-943
Number of pages19
JournalIEEE Transactions on Software Engineering
Volume41
Issue number9
DOIs
StatePublished - Sep 1 2015

All Science Journal Classification (ASJC) codes

  • Software

Fingerprint

Dive into the research topics of 'Program Characterization Using Runtime Values and Its Application to Software Plagiarism Detection'. Together they form a unique fingerprint.

Cite this