Behavior based software theft detection

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2009, Pages 280-290

  Wang, Xinran ^a   Jhi, Yoon Chan ^a   Zhu, Sencun ^a,b   Liu, Peng ^b  

^a The Center for Nanotechnology Education and Utilization   (United States)

^b PENNSYLVANIA STATE UNIVERSITY   (United States)

Author keywords

Dynamic analysis; Software birthmark; Software plagiarism; Software theft

Indexed keywords

BEHAVIOR-BASED; BEHAVIORAL CHARACTERISTICS; COMPILER OPTIMIZATIONS; DEPENDENCE GRAPHS; DETECTION SYSTEM; OPEN SOURCE PROJECTS; SOFTWARE COMPONENT; SOFTWARE INDUSTRY; SYSTEM CALLS; TWO-STATE;

CRIME; DYNAMIC ANALYSIS; NETWORK SECURITY; PROGRAM COMPILERS;

COMPUTER SOFTWARE;

EID: 74049163233     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1653662.1653696     Document Type: Conference Paper

References (31)

1. [online]Available from World Wide Web: http://news.zdnet.com/2100-3513- 22-5629876.html.
2. Elsa: An elkhound-based c++ parser, http://www.cs.berkeley.edu/~smcpeak/ elkhound.
3. The gecko engine, http://en.wikipedia.org/wiki/Gecko-layout-engine.
4. Khtml engine, http://en.wikipedia.org/wiki/KHTML.
5. B. S. Baker. On finding duplication and near duplication in large software systems. In Proc. of 2nd Working Conf. on Reverse Engineering, 1995.
6. H. G. Baker. Minimizing reference count updating with deferred and anchored pointers for functional data structures. ACM SIGPLAN Notices, 29:29-9, 1994.
7. I. D. Baxter, A. Yahin, L. Moura, M. Sant'Anna, and L. Bier. Clone detection using abstract syntax trees. In Int. Conf. on Software Maintenance, 1998.
8. M. Christodorescu, S. Jha, and C. Kruegel. Mining specifications of malicious behavior. In Proceedings of ESEC/FSE, 2008.
9. C. Collberg, E. Carter, S. Debray, A. Huntwork, C. Linn, and M. Stepp. Dynamic path-based software watermarking. In Proceedings of the Conference on Programming Language Design and Implementation, 2004.
10. C. Collberg and C. Thomborson. Software watermarking: Models and dynamic embeddings. In Principles of Programming Languages 1999, Jan. 1999.
11. C. Collberg, C. Thomborson, and D. Low. A taxonomy of obfuscating transformations. Technical Report 148, The Univeristy of Auckland, July 1997.
12. C. Hoffman. Group-theoretic Algorithms and Graph Isomorphism. Springer Verlag, 1982.
13. J. E. Hopcroft and J. K. Wong. Linear time algorithm for isomorphism of planar graphs. In ACM Symp. on Theory of Computing, 1974.
14. J. E. Hopcroft and J. K. Wong. Performance evaluation of the vf graph matching algorithm. In Processing of 10th Int. Conf. on Image Analysis and Processing, 1999.
15. T. Kamiya, S. Kusumoto, and K. Inoue. Ccfinder: a multilinguistic token-based code clone detection system for large scale source code. IEEE Trans. Softw. Eng., 28(7), 2002.
16. E. Kirda, C. Kruegel, G. Banks, G. Vigna, and R. A. Kemmerer. Behavior-based spyware detection. In Proceedings of the 15th conference on USENIX Security Symposium, 2006.
17. K. Kontogiannis, M. Galler, and R. DeMori. Detecting code similarity using patterns. In Working Notes of 3rd Workshop on AI and Software Engineering, 1995.
18. J. Krinke. Identifying similar code with program dependence graphs. In Proc. of 8th Working Conf. on Reverse Engineering, 2001.
19. C. Liu, C. Chen, J. Han, and P. S. Yu. Gplag: detection of software plagiarism by program dependence graph analysis. In Proceedings of the 12th ACM SIGKDD international conference on Knowledge discovery and data mining, 2006.
20. M. Madou, L. Van Put, and K. De Bosschere. Loco: An interactive code (de)obfuscation tool. In Proceedings of ACM SIGPLAN 2006 Workshop on Partial Evaluation and Program Manipulation (PEPM '06), pages 140-144, 2006.
21. G. Myles and C. Collberg. Detecting software theft via whole program path birthmarks. In ISC, pages 404-415, 2004.
22. G. Myles and C. S. Collberg. K-gram based software birthmarks. In SAC, 2005.
23. N. Nethercote and J. Seward. Valgrind: a framework for heavyweight dynamic binary instrumentation. In Proceedings of the 2007 ACM SIGPLAN conference on Programming language design and implementation.
24. L. Prechelt, G. Malpohl, and M. Philippsen. Finding plagiarisms among a set of programs with jplag. Universal Computer Science, 2000. Available from World Wide Web: citeseer.ist.psu.edu/article/ prechelt01finding.html.
25. S. Schleimer, D. S. Wilkerson, and A. Aiken. Winnowing: local algorithms for document fingerprinting. In Proc. of ACM SIGMOD Int. Conf. on Management of Data, 2003.
26. D. Schuler, V. Dallmeier, and C. Lindig. A dynamic birthmark for java. In ASE '07: Proceedings of the twenty-second IEEE/ACM international conference on Automated software engineering, 2007.
27. H. Tamada, M. Nakamura, A. Monden, and K. ichi Matsumoto. Design and evaluation of birthmarks for detecting theft of java programs. In Proc. IASTED International Conference on Software Engineering, 2004.
28. H. Tamada, K. Okamoto, M. Nakamura, and A. Monden. Dynamic software birthmarks to detect the theft of windows applications. In International Symposium on Future Software Technology 2004.
29. H. Tamada, K. Okamoto, M. Nakamura, A. Monden, and K. ichi Matsumoto. Design and evaluation of dynamic software birthmarks based on api calls. Technical report, Nara Institute of Science and Technology, 2007.
30. J. R. Ullmann. An algorithm for subgraph isomorphism. Journal of the ACM, 23(1):31-42, 1976.
31. X. Zhang, S. Tallam, and R. Gupta. Dynamic slicing long running programs through execution fast forwarding. In Processing of 14th ACM SIGSOFT Symposium on Foundations of Softw. Eng., 2006.