1. 南开大学计算机与控制工程学院,天津,300350
2. 中国民航大学信息安全测评中心,天津,300300
3. 河北省高可信信息系统重点实验室,河北,保定,071002
4. 南开大学计算机与控制工程学院,天津,300350
5. 中国民航大学信息安全测评中心,天津,300300
6. 河北省高可信信息系统重点实验室,河北,保定,071002
纸质出版:2018
移动端阅览
陈喆, 贾春福, 宗楠, 等. 随机森林在程序分支混淆中的应用[J]. 电子学报, 2018,46(10):2458-2466.
CHEN Zhe, JIA Chun-fu, ZONG Nan, et al. Branch Obfuscation Using Random Forest[J]. Acta Electronica Sinica, 2018, 46(10): 2458-2466.
陈喆, 贾春福, 宗楠, 等. 随机森林在程序分支混淆中的应用[J]. 电子学报, 2018,46(10):2458-2466. DOI: 10.3969/j.issn.0372-2112.2018.10.020.
CHEN Zhe, JIA Chun-fu, ZONG Nan, et al. Branch Obfuscation Using Random Forest[J]. Acta Electronica Sinica, 2018, 46(10): 2458-2466. DOI: 10.3969/j.issn.0372-2112.2018.10.020.
程序中的路径信息在程序执行过程中会被动态地泄露,基于路径敏感技术的逆向工程可自动地收集程序中的条件跳转指令,从而理解程序的内部逻辑.为了缓解路径信息泄露,提出了一种基于随机森林的路径分支混淆方法,将逆向分析路径分支信息的难度等价于抽取随机森林规则的难度.鉴于随机森林分类器可被视为一种黑盒,其内部规则难以被提取且分类过程与路径分支行为相似,因此经过特殊训练的随机森林可以在功能上替代路径分支.将该方法部署于SPECint-2006标准测试集中的6个程序进行实验,实验结果表明该混淆方法有效地保护了路径分支信息,引发的额外开销较低,具有实用性.
Reverse engineering can automatically collect the path information which has been leaked in program run-time
and then reveal the internal logics of programs. To mitigate path information leaking
this paper proposes a novel path obfuscator to combat state-of-art reverse engineering by using random forest. The difficulty of reversing the obfuscated branch is equivalent to extracting rules from random forests. Since random forests can be regarded as black-box and the categorizing process has high similarity with the behavior of path branch
so the specially trained random forest can realize the functionality of path branch. The proposed obfuscator had been deployed on six programs from SPECint-2006 benchmarks. The experimental results show that our method has significantly increased the computational cost of reverse engineering
and the introduced overhead is acceptable.
0
浏览量
3
下载量
4
CSCD
关联资源
相关文章
相关作者
相关机构
京公网安备11010802024621