Program obfuscation: a quantitative approach

Despite the recent advances in the theory underlying obfuscation, there still is a need to evaluate the quality of practical obfuscating transformations more quickly and easily. This paper presents the first steps toward a comprehensive evaluation suite consisting of a number of deobfuscating transformations and complexity metrics that can be readily applied on existing and future transformations in the domain of binary obfuscation. In particular, a framework based on software complexity metrics measuring four program properties: code, control flow, data and data flow is suggested. A number of well-known obfuscating and deobfuscating transformations are evaluated based upon their impact on a set of complexity metrics. This enables us to quantitatively evaluate the potency of the (de)obfuscating transformations. Categories and Subject Descriptors D.2.0 [Software Engineering]: General—protection mechanisms; K.4.4 [Computing Milieux]: Electronic Commerce—security General Terms Mea...

• Type: Conference
• Year: 2007
• Where: CCS
• Authors: Bertrand Anckaert, Matias Madou, Bjorn De Sutter, Bruno De Bus, Koen De Bosschere, Bart Preneel
• Keywords: CCS 2007, Complexity Metrics, Practical Obfuscating Transformations, Security Privacy, Theory Underlying Obfuscation