Detecting Software Theft via System Call Based Birthmarks

—Along with the burst of open source projects, software theft (or plagiarism) has become a very serious threat to the healthiness of software industry. Software birthmark, which represents the unique characteristic of a program, can be used for software theft detection. We propose two system call based software birthmarks: SCSSB (System Call Short Sequence Birthmark) and IDSCSB (Input Dependant System Call Subsequence Birthmark), and examine how well they reflect unique behavioral characteristics of a program. To our knowledge, our detection system based on SCSSB and IDSCSB is the first one that is capable of software component theft detection where only partial code is stolen. We demonstrate the strength of our birthmarks against various evasion techniques, including those based on different compilers and different compiler optimization levels as well as those based on very powerful obfuscation techniques supported by SandMark. Unlike the existing work that were evaluated through ...

• Type: Conference
• Year: 2009
• Where: ACSAC
• Authors: Xinran Wang, Yoon-chan Jhi, Sencun Zhu, Peng Liu
• Keywords: ACSAC 2009, Security Privacy, Software Birthmarks, Software Theft, Theft Detection