Exploiting dynamic scheduling for VM-based code obfuscation

Kuang, Kaiyuan and Tang, Zhanyong and Gong, Xiaoqing and Fang, Dingyi and Chen, Xiaojiang and Xing, Tianzhang and Ye, Guixin and Zhang, Jie and Wang, Zheng (2016) Exploiting dynamic scheduling for VM-based code obfuscation. In: The 15th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (IEEE TrustCom-16). 2016 IEEE Trustcom/BigDataSE/I​SPA . IEEE, CHN, pp. 489-496. ISBN 9781509032068

[img]
Preview
PDF (camera_ready_paper)
camera_ready_paper.pdf - Accepted Version

Download (1MB)

Abstract

Code virtualization built upon virtual machine (VM) technologies is emerging as a viable method for implementing code obfuscation to protect programs against unauthorized analysis. State-of-the-art VM-based protection approaches use a fixed scheduling structure where the program follows a single, static execution path for the same input. Such approaches, however, are vulnerable to certain scenarios where the attacker can reuse knowledge extracted from previously seen software to crack applications using similar protection schemes. This paper presents DSVMP, a novel VM-based code obfuscation approach for software protection. DSVMP brings together two techniques to provide stronger code protection than prior VM-based schemes. Firstly, it uses a dynamic instruction scheduler to randomly direct the program to execute different paths without violating the correctness across different runs. By randomly choosing the program execution paths, the application exposes diverse behavior, making it much more difficult for an attacker to reuse the knowledge collected from previous runs or similar applications to perform attacks. Secondly, it employs multiple VMs to further obfuscate the relationship between VM bytecode and their interpreters, making code analysis even harder. We have implemented DSVMP in a prototype system and evaluated it using a set of widely used applications. Experimental results show that DSVMP provides stronger protection with comparable runtime overhead and code size when compared to two commercial VMbased code obfuscation tools.

Item Type:
Contribution in Book/Report/Proceedings
ID Code:
80270
Deposited By:
Deposited On:
10 Aug 2016 10:12
Refereed?:
Yes
Published?:
Published
Last Modified:
24 Oct 2020 07:40