基于行为的软件胎记技术研究

发布时间：2018-04-30 19:40

本文选题：软件抄袭 + 软件胎记　；参考：《南京大学》2013年硕士论文

【摘要】：随着软件产业的迅猛发展以及开源项目的日益流行,软件窃取已经严重威胁软件产业的健康发展。为保护软件的知识产权,有学者提出了软件水印技术。软件水印可以用来标识软件的作者、软件的发行商、软件的所有者以及软件的使用者等信息,可以用来鉴别出非法复制和盗用的软件产品。然而,软件水印需要额外嵌入代码,并且很容易被软件混淆和编译器优化所破坏。因此,继软件水印技术之后,软件胎记利用程序的某些特征,可以用来验证软件的来源,防止软件盗版。目前最为先进的软件胎记技术—基于软件动态系统调用依赖关系图(SCDG),根据程序动态运行时的行为特征,捕捉系统调用之间参数的依赖关系,并以此独有的特点作为软件的胎记。这种技术能够检测出程序之间部分拷贝的情况,同时能够较好的躲过已有的混淆技术和无用系统调用(no-ops)的插入攻击。在本文中,我们重点对基于系统调用依赖关系图(SCDG)的软件胎记技术及其混淆技术进行了研究。首先,我们利用Valgrind提供的动态二进制分析框架和对外编程接口,在已有的Hawk工具的基础上,实现了这种基于系统调用依赖关系图的软件胎记的提取。同时我们对比了经典的图-子图匹配算法,选择了更加适合我们实验背景的VF2算法,对得到的软件胎记进行匹配,并利用NetworkX库开发了相应的检查工具。在这些工作的基础上,我们继续分析了这种基于系统调用依赖关系图的软件胎记技术的弱点,提出一种同语义转换的系统调用混淆技术,可以巧妙地躲避已有的检测。我们从系统调用依赖关系图(SCDG)的结构入手,选择在原有的系统调用依赖关系对中插入冗余的系统调用,用一个新的系统调用和两条依赖边替换原来的一条依赖边,以此改变原有的图结构并保证原有的程序功能不变。我们选用已被证实存在复用关系的两个程序对我们的系统调用依赖关系的提取工作进行验证,并且经过我们的检查工具,确实发现存在抄袭。这同时也证明了我们工作的准确性。此外,我们还从有效性和性能两方面,对我们的混淆系统进行了评估。实验证明,我们的混淆方案能够有效破坏原有的软件胎记,达到了很好的混淆目的。并且我们系统的性能损耗很低,且这些开销基本上来自新插入的系统调用。虽然,我们的混淆技术可以用于软件胎记的攻击,但是我们旨在软件保护领域做出新的探索,无意增加新的攻击。我们提出的基于系统调用的混淆技术,也为实现软件多样性提供了新的思路。
[Abstract]:With the rapid development of software industry and the increasing popularity of open source projects, software theft has seriously threatened the healthy development of software industry. In order to protect the intellectual property of software, some scholars put forward software watermarking technology. Software watermarking can be used to identify software authors, software distributors, software owners, software users and other information, can be used to identify illegal replication and theft of software products. However, software watermarking requires additional embedded code and is easily compromised by software confusion and compiler optimization. Therefore, after software watermarking technology, software birthmarks can be used to verify the source of software and prevent software piracy. At present, the most advanced software birthmark technology, based on the software dynamic system call dependency graph (SCDGG), captures the parameter dependence relationship between the system calls according to the behavior characteristics of the program dynamic running, and this unique feature is used as the birthmark of the software. This technique can detect some copies between programs, and avoid the obfuscation technique and no-ops insertion attack. In this paper, we focus on the software birthmark technology based on system call dependency graph (SCDG) and its obfuscation technique. Firstly, using the dynamic binary analysis framework provided by Valgrind and the external programming interface, we realize the extraction of birthmarks based on the system call dependency graph based on the existing Hawk tools. At the same time, we compare the classical graph-subgraph matching algorithm, select the VF2 algorithm which is more suitable for our experimental background, match the birthmarks of the software, and develop the corresponding checking tools by using the NetworkX library. On the basis of these works, we continue to analyze the weakness of this software birthmark technology based on system call dependency graph, and propose a system call confusion technique with semantic transformation, which can avoid the existing detection skillfully. Starting with the structure of the system call dependency graph (SCDG), we choose to insert redundant system calls into the original system call dependency pair, and replace the original dependency edge with a new system call and two dependent edges. This changes the original graph structure and ensures that the original program function remains unchanged. We use two programs that have been proved to have reuse relationship to verify the extraction of system call dependency. Through our checking tools, we do find that plagiarism exists. It also proves the accuracy of our work. In addition, we evaluate our confusion system in terms of effectiveness and performance. Experiments show that our confusion scheme can effectively destroy the original software birthmarks, and achieve a good purpose of confusion. And our system performance loss is very low, and these overhead basically comes from the newly inserted system call. Although our obfuscation technology can be used to attack software birthmarks, we aim to make new explorations in the field of software protection and have no intention of adding new attacks. The obfuscation technique based on system call also provides a new way to realize the diversity of software.
【学位授予单位】：南京大学
【学位级别】：硕士
【学位授予年份】：2013
【分类号】：TP309

【相似文献】