Software Birthmark Method Using Combined Structure–Based and API–Based
Donghoon Lee, Dongwoo Kang, Jiye Kim, Dongho Won · Journal of Software · 2017
The software birthmarking technique has traditionally been studies in fields such as software piracy, code theft, and copyright infringement. In this paper, we propose a static software birthmark technique that is combined by the structure–based and API–based. Our proposed software birthmark technique is based on procedures that contain the call sequence, including the interprocedural and APIs in the distributed softwares with native code. The procedure birthmark is translated to the ordered tree by call-chain of interprocedural analysis. Finally, the software birthmark generates a list of pq-gram with the ordered trees translated from each procedure. Our experiment performed with variant malwares. These malware are shown that can be distinguished from one another in our method.