• Journal of Korea Multimedia Society
• /
• v.10 no.5
• /
• pp.668-678
• /
• 2007

The development of a wire and wireless communication technologies might permit easily accessing on various information. But, the easiness of accessing information has basically the problem of an unintended information outflow. An executable file which has key algorithms, data and resources for itself has very weak point in the security. Because the various information such as algorithms, data and resources is included in an executable file on embedded systems or virtual machines, the information outflow problem may appear more seriously. In this paper, we propose a technique which can be protecting the executable file contents for resolving the outflow problem through the encryption. Experimentally, we applied the proposed technique to EVM-the virtual machine for embedded system and verified it. Also, we tried a benchmark test for the proposed technique and obtained reasonable performance overhead.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.4
• /
• pp.785-802
• /
• 2017

As cyber threats using malicious code continue to increase, many security and vaccine companies are putting a lot of effort into analysis and detection of malicious codes. However, obfuscation techniques that make software analysis more difficult are applied to malicious codes, making it difficult to respond quickly to malicious codes. In particular, commercial obfuscation tools can quickly and easily generate new variants of malicious codes so that malicious code analysts can not respond to them. In order for analysts to quickly analyze the actual malicious behavior of the new variants, reverse obfuscation(=de-obfuscation) is needed to disable obfuscation. In this paper, general analysis methodology is proposed to de-obfuscate the software used by a commercial obfuscation tool, Themida. First, We describe operation principle of Themida by analyzing obfuscated executable file using Themida. Next, We extract original code and data information of executable from obfuscated executable using Pintool, DBI(Dynamic Binary Instrumentation) framework, and explain the implementation results of automated analysis tool which can deobfuscate to original executable using the extracted original code and data information. Finally, We evaluate the performance of our automated analysis tool by comparing the original executable with the de-obfuscated executable.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.6
• /
• pp.1553-1561
• /
• 2018

The source code for Android is open and easy to modify depending on the purpose. Recently, this charateristic has been exploited to bypass the runtime protection technique and extract the original executable code. Unfortunately, Android devices are so fragmented that it is difficult to verify the integrity of the system. To solve this problem, this paper proposes a technique to verify the integrity of the execution environment indirectly using the features of the application permission. Before executing the original executable code, it loads and executes the dummy DEX file to monitor for abnormal events and determine whether the system is intact. The proposed technique shows a performance overhead of about 2 seconds and shows that it can detect the bypassing technique that is currently disclosed.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.3
• /
• pp.521-530
• /
• 2017

In this paper, we propose a protection solution against intelligent Ransomware attacks by encrypting not only source files but also backup files of external storage. The system is designed to automatically back up to the cloud server at the time of file creation to perform monitoring and blocking in case a specific process affects the original file. When client creates or saves a file, both process identifiers, parent process identifiers, and executable file hash values are compared and protected by the whitelist. The file format that is changed by another process is monitored and blocked to prevent from suspicious behavior. By applying the system proposed in this paper, it is possible to protect against damage caused by the modification or deletion of files by Ransomware.

• Journal of the Korea Convergence Society
• /
• v.10 no.1
• /
• pp.61-69
• /
• 2019

As smartphones become widespread, numerous applications are developed and social issues related to software copyright are emerging. Software watermarking is digital watermarking technology applied to software and is a technology that can be used to recognize copyright owners. Generally, Java language is used to develop applications on the Android environment. The Java is an object-oriented language that supports method overloading and overriding. In this paper, we propose and implement a method generation based watermarking technique. As a result of evaluating the overhead due to the watermark, it was confirmed that the increase of the executable file size and the decrease of the execution speed are not large. Using the watermarking technique proposed in this paper, it is expected that copyright information can be verified when illegal copying is suspected or actual program is stolen, and piracy attempts will be prevented in advance.