Article ID | Journal | Published Year | Pages | File Type |
---|---|---|---|---|
459111 | Journal of Systems and Software | 2009 | 12 Pages |
Abstract
A software birthmark is the inherent characteristics of a program extracted from the program itself. By comparing birthmarks, we can detect whether a program is a copy of another program or not. We propose a static API birthmark for Windows executables that utilizes sets of API calls identified by a disassembler statically. By comparing 49 Windows executables, we show that our birthmark can distinguish similar programs and detect copies. By comparing binaries generated by various compilers, we also demonstrate that our birthmark is resilient. We compare our birthmark with a previous Windows dynamic birthmark to show that it is more appropriate for GUI applications.
Related Topics
Physical Sciences and Engineering
Computer Science
Computer Networks and Communications
Authors
Seokwoo Choi, Heewan Park, Hyun-il Lim, Taisook Han,