A Static Birthmark of Binary Executables Based on API Call Structure

Abstract. A software birthmark is a unique characteristic of a program that can be used as a software theft detection. In this paper we suggest and empirically evaluate a static birthmark of binary executables based on API call structure. The program properties employed in this birthmark are functions and standard API calls when the functions are executed. The API calls from a function includes the API calls explicitly found from the function and its descendants within limited depth in the call graph. To statically identify functions, call graphs and API calls, we utilizes IDAPro disassembler and its plug-ins. We define the similarity between two functions as the proportion of the number of all API calls to the number of the common API calls. The similarity between two programs is obtained by the maximum weight bipartite matching between two programs using the function similarity matrix. To show the credibility of the proposed techniques, we compare the same applications with differe...

• Type: Conference
• Year: 2007
• Where: ASIAN
• Authors: Seokwoo Choi, Heewan Park, Hyun-il Lim, Taisook Han
• Keywords: Algorithms, API Calls, ASIAN 2007, Birthmark, Software Birthmark