• Journal of KIISE:Computing Practices and Letters
• /
• v.14 no.9
• /
• pp.911-915
• /
• 2008

Software birthmark is the inherent characteristics that can identify a program. In this paper, we propose a Java class theft detection technique based on static API traces of class files. We utilize control flow analysis to increase resilience, and we apply the semi-global alignment trace comparison algorithm to increase credibility. The credibility and resilience experiments for XML parsers show that our birthmark is more efficient than existing birthmarks.

• Journal of KIISE:Software and Applications
• /
• v.37 no.5
• /
• pp.394-402
• /
• 2010

JavaScript is one of the most popular languages to develope web sites and web applications. Since applicationss written in JavaScript are sent to clients as the original source code, they are easily exposed to plagiarists. Therefore, a method to detect plagiarized JavaScript programs is necessary. The conventional program dependency graph(PDG) based approaches are not suitable to analyze JavaScript programs because they do not reflect dynamic features of JavaScript. They also generate false positives in some cases and show inefficiency with large scale search space. We devise a JavaScript specific PDG(JS PDG) that captures dynamic features of JavaScript and propose a JavaScript plagiarism detection method for precise and fast detection. We evaluate the proposed plagiarism detection method with experiment. Our experiments show that our approach can detect false-positives generated by conventional PDG and can prune the plagiarism search space.

• Journal of KIISE:Software and Applications
• /
• v.36 no.9
• /
• pp.767-776
• /
• 2009

A software birthmark is a set of characteristics that are extracted from a program itself to detect code theft. A dynamic API birthmark is extracted from the run-time API call sequences of a program. The dynamic Windows API birthmarks of Tamada et al. are extracted from API call sequences during the startup period of a program. Therefore. the dynamic birthmarks cannot reflect characteristics of main functions of the program. In this paper. we propose a functional unit birthmark(FDAPI) that is defined as API call sequences recorded during the execution of essential functions of a program. To find out that some functional units of a program are copied from an original program. two FDAPIs are extracted by executing the programs with the same input. The FDAPIs are compared using the semi-global alignment algorithm to compute a similarity between two programs. Programs with the same functionality are compared to show credibility of our birthmark. Binary executables that are compiled differently from the same source code are compared to prove resilience of our birthmark. The experimental result shows that our birthmark can detect module theft of software. to which the existing birthmarks of Tamada et al. cannot be applied.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.868-871
• /
• 2011

소프트웨어 버스마크는 모든 프로그램에 이미 포함되어 있으며 서로 다른 프로그램을 식별하는데 사용될 수 있는 프로그램의 고유한 특징을 말한다. 본 논문에서는 소프트웨어 버스마크를 이용하여 안드로이드 앱 사이의 유사도를 측정하고 코드 도용 탐지에 활용하는 방법을 제안하였고, 다양한 카테고리의 안드로이드 앱에 대한 유사도 비교 실험을 하였다. 먼저, 같은 개발사에서 만든 유사한 프로그램을 대상으로 버스마크 유사도를 측정한 결과 유사도가 매우 높다는 것을 확인하였다. 또한, 서로 다른 개발사에서 만든 유사한 카테고리의 프로그램을 비교하였고 비슷한 프로그램이라도 서로 다른 개발사에서 만든 앱이기 때문에 유사도가 낮다는 것을 확인하였다. 마지막으로, 서로 다른 개발사의 유사한 프로그램들 중에서 유사도가 높게 측정된 경우를 탐지한 실험 결과를 제시하였다. 이러한 유사 앱들은 실제로 공통 클래스를 함께 포함하고 있었다. 실험 결과들을 바탕으로 소프트웨어 버스마크가 안드로이드 앱 사이의 공통 클래스를 탐지하는데 활용될 수 있음을 확인하였고, 더 나아가 안드로이드 앱에서의 코드 도용을 탐지하는 목적으로도 활용될 수 있음을 보여주었다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.05a
• /
• pp.687-690
• /
• 2013

소프트웨어 버스마크 기법은 도용이 의심되는 소프트웨어의 소스 코드를 얻을 수 없을 때 사용할 수 있는 소프트웨어 도용 탐지 기법이다. 이 기법은 프로그램의 바이너리나 자바 클래스 파일에서 프로그램 고유의 특징인 버스마크를 추출한 다음 프로그램간 버스마크 유사도 측정을 통해 도용을 탐지한다. 이 논문에서는 선행 연구된 k그램 버스마크 기법에 연산자 요약이라는 아이디어를 접목한 연산자 요약 k그램 버스마크 기법을 제안한다. 연산자 요약이란 연산자 우선순위가 같은 연산자의 JVM 명령어를 묶어 요약번호로 나타내는 것이다. 연산자 요약 k그램 버스마크 기법은 연산자 요약과 제어 흐름을 고려하여 생성한 연속된 k개의 요약번호 시퀀스 집합을 버스마크로 정의한다. 버스마크를 평가하기 위해 선택 정렬 메소드와 버블 정렬 메소드를 대상으로 신뢰도 실험과 강인도 실험을 하였다. 실험 결과 연산자 요약 k그램 버스마크 기법이 선행 연구된 Tamada 버스마크 기법과 k그램 버스마크 기법보다 높은 신뢰도와 강인도를 보였다.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.4
• /
• pp.177-180
• /
• 2013

A software birthmark means inherent characteristics that can be used to identify a program. Because the software birthmark is difficult to remove by simple program transformation, it can be used to detect code theft. In this paper, we propose a birthmark technique based on API k-gram of Android applications. Android SDK provides various libraries that help programmers to develop application easily. In order to use Android SDK, we have to use API method calls. The API call instructions are hard to be replaced or removed, so they can be a inherent characteristics of an application. To show the effectiveness of the proposed birthmark, we compared it with previous birthmarks and evaluated it with open source applications. From the experiments, we verified that the credibility and resilience of our birthmark is higher than previous birthmarks.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.40 no.4
• /
• pp.700-708
• /
• 2015

A software birthmark is the set of characteristics of a program which can be used to identify the program. Many researchers have studied on detecting theft of java programs using some birthmarks. In case of Android apps, code obfuscation techniques are used to protect the apps against reverse-engineering and tampering. However, attackers can also use the obfuscation techniques in order to conceal a stolen program. A birthmark (feature) of an app can be alterable by code obfuscations. Therefore, it is necessary to detect Android app theft based on the birthmark which is resilient to code obfuscation. In this paper, we propose an effective Android app birthmark and app theft detection through the proposed birthmark. By analyzing some obfuscation tools, we have first selected parameter and the return types of methods as an adequate birthmark. Then, we have measured similarity of target apps using the birthmarks extracted from the apps, where some target apps are not obfuscated and the others obfuscated. The measurement results show that our proposed birthmark is effective for detecting Android app theft even though the apps are obfuscated.

• The Journal of Korean Institute of Next Generation Computing
• /
• v.13 no.3
• /
• pp.15-25
• /
• 2017

As the value and importance of softwares are growing up, software theft and piracy become a much larger problem. To tackle this problem, it is highly required to provide an accurate method for detecting software theft and piracy. Especially, while software theft is relatively easy in the case of Android applications (apps), screening illegal apps has not been properly performed in Android markets. In this paper, we propose a method to effectively measure the similarity between Android apps for detecting software theft at the executable file level. Our proposed method extracts method reference frequency and manifest information through static analysis of executable Android apps as the main features for similarity measurement. Each app is represented as an n-dimensional vectors with the features, and then cosine similarity is utilized as the similarity measure. We demonstrate the effectiveness of our proposed method by evaluating its accuracy in comparison with typical source code-based similarity measurement methods. As a result of the experiments for the Android apps whose source file and executable file are available side by side, we found that our similarity degree measured at the executable file level is almost equivalent to the existing well-known similarity degree measured at the source file level.

• Journal of the Korea Society of Computer and Information
• /
• v.28 no.7
• /
• pp.85-93
• /
• 2023

Software birthmark refers to a unique feature inherent in software that can be extracted from program binaries even in the absence of the original source code of the program. Like human genetic information, the similarity between programs can be calculated numerically, so it can be used to determine whether software is stolen or copied. In this paper, we propose a new birthmark technique for Android applications developed using Unity. The source codes of Unity-based Android applications use C# language, and since the core logic of the program is included in the DLL module, it must be approached in a different way from normal Android applications. In this paper, a Unity birthmark extraction and comparison system was implemented, and reliability and resilience were evaluated. The use of the Unity birthmark technique proposed in this paper is expected to be effective in preventing illegal copy or code theft of the Unity-based Android applications.

• Journal of KIISE
• /
• v.42 no.6
• /
• pp.713-722
• /
• 2015

As open-source software (OSS) becomes more widely used, many users breach the terms in the license agreement of OSS, or reuse a vulnerable OSS module. Therefore, a technique needs to be developed for investigating if a binary program includes an OSS module. In this paper, we propose an efficient technique to detect a particular OSS module in an executable program using its function-level features. The conventional methods are inappropriate for determining whether a module is contained in a specific program because they usually measure the similarity between whole programs. Our technique determines whether an executable program contains a certain OSS module by extracting features such as its function-level instructions, control flow graph, and the structural attributes of a function from both the program and the module, and comparing the similarity of features. In order to demonstrate the efficiency of the proposed technique, we evaluate it in terms of the size of features, detection accuracy, execution overhead, and resilience to compiler optimizations.