Detecting binary theft via static major-path birthmarks

Abstract

Software birthmarks are used for detecting software plagiarism. For binaries, not many reliable birthmarks are developed. API sequences are known to be successful birthmarks, but dynamically extracted sequences are often too large and unnecessarily repetitive. In this paper, we propose a static approach to generate API sequences along major paths, which are analyzed from control flow graphs of binaries. Since our API sequences are extracted along the most plausible paths of the binary codes, they can represent actual API sequences from executing binaries, but in a more concise form. In addition, as it is a static analysis, we can apply to partial binary objects, which cannot be executed on their own. Our similarity measures use the Smith-Waterman algorithm that is one of the popular sequence alignment algorithms for DNA sequence analysis. We evaluate our static path-based API sequence with multiple versions of five applications. In our experiment, our method reports a quite reliable similarity result for binary codes.