Characterizing a property-driven obfuscation strategy

In recent years, code obfuscation has attracted both researchers and software developers as a useful technique for protecting secret properties of proprietary programs. The idea of code obfuscation is to modify a program, while preserving its functionality, in order to make it more difficult to analyze. Thus, the aim of code obfuscation is to conceal certain properties to an attacker, while revealing its intended behavior. However, a general methodology for deriving an obfuscating transformation from the properties to conceal and reveal is still missing. In this work, we start to address this problem by studying the existence and the characterization of function transformers that minimally or maximally modify a program in order to reveal or conceal a certain property. Based on this general formal framework, we are able to provide a characterization of the maximal obfuscating strategy for transformations concealing a given property while revealing the desired observational behavior. To conclude, we discuss the applicability of the proposed characterization by showing how some common obfuscation techniques can be interpreted in this framework. Moreover, we show how this approach allows us to deeply understand what are the behavioral properties that these transformations conceal, and therefore protect, and which are the ones that they reveal, and therefore disclose.

[1]  Roberto Giacobazzi,et al.  Transforming Abstract Interpretations by Abstract Interpretation , 2008, SAS.

[2]  Atsuko Miyaji,et al.  Software Obfuscation on a Theoretical Basis and Its Implementation , 2003, IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences.

[3]  Stephen Drape,et al.  Slicing obfuscations: design, correctness, and evaluation , 2007, DRM '07.

[4]  Yuan Xiang Gu,et al.  An Approach to the Obfuscation of Control-Flow of Sequential Computer Programs , 2001, ISC.

[5]  Saumya K. Debray,et al.  Obfuscation of executable code to improve resistance to static disassembly , 2003, CCS '03.

[6]  Patrick Cousot,et al.  Systematic design of program analysis frameworks , 1979, POPL.

[7]  Koen De Bosschere,et al.  Opaque Predicates Detection by Abstract Interpretation , 2006, AMAST.

[8]  Roberto Giacobazzi,et al.  Making abstract interpretations complete , 2000, JACM.

[9]  Isabella Mastroeni,et al.  Abstract Program Slicing: From Theory towards an Implementation , 2010, ICFEM.

[10]  Clark Thomborson,et al.  Manufacturing cheap, resilient, and stealthy opaque constructs , 1998, POPL '98.

[11]  Amit Sahai,et al.  On the (im)possibility of obfuscating programs , 2001, JACM.

[12]  Patrick Cousot,et al.  Constructive design of a hierarchy of semantics of a transition system by abstract interpretation , 2002, MFPS.

[13]  Gregory R. Andrews,et al.  Binary Obfuscation Using Signals , 2007, USENIX Security Symposium.

[14]  David W. Binkley,et al.  Program slicing , 2008, 2008 Frontiers of Software Maintenance.

[15]  Roberto Giacobazzi,et al.  Obfuscation by partial evaluation of distorted interpreters , 2012, PEPM '12.

[16]  Peter Sestoft,et al.  Partial evaluation and automatic program generation , 1993, Prentice Hall international series in computer science.

[17]  Roberto Giacobazzi,et al.  Semantics-based code obfuscation by abstract interpretation , 2009, J. Comput. Secur..

[18]  Roberto Giacobazzi,et al.  Hiding Information in Completeness Holes: New Perspectives in Code Obfuscation and Watermarking , 2008, 2008 Sixth IEEE International Conference on Software Engineering and Formal Methods.

[19]  Roberto Giacobazzi,et al.  Abstract non-interference: parameterizing non-interference by abstract interpretation , 2004, POPL.

[20]  Roberto Giacobazzi,et al.  Semantic-Based Code Obfuscation by Abstract Interpretation , 2005, ICALP.

[21]  Roberto Giacobazzi,et al.  Weakening Additivity in Adjoining Closures , 2015, Order.

[22]  Mark Harman,et al.  A formalisation of the relationship between forms of program slicing , 2006, Sci. Comput. Program..

[23]  Patrick Cousot,et al.  Systematic design of program transformation frameworks by abstract interpretation , 2002, POPL '02.

[24]  Christian S. Collberg,et al.  Software watermarking: models and dynamic embeddings , 1999, POPL '99.

[25]  Neil D. Jones,et al.  Transformation by interpreter specialisation , 2004, Sci. Comput. Program..

[26]  K. Hofmann,et al.  A Compendium of Continuous Lattices , 1980 .

[27]  Roberto Giacobazzi,et al.  Maximal incompleteness as obfuscation potency , 2016, Formal Aspects of Computing.

[28]  Keith D. Cooper,et al.  Engineering a Compiler , 2003 .

[29]  Christian S. Collberg,et al.  Watermarking, Tamper-Proofing, and Obfuscation-Tools for Software Protection , 2002, IEEE Trans. Software Eng..

[30]  Roberto Giacobazzi,et al.  Uniform Closures: Order-Theoretically Reconstructing Logic Program Semantics and Abstract Domain Refinements , 1998, Inf. Comput..

[31]  Roberto Giacobazzi,et al.  Control code obfuscation by abstract interpretation , 2005, Third IEEE International Conference on Software Engineering and Formal Methods (SEFM'05).

[32]  Patrick Cousot,et al.  Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints , 1977, POPL.

[33]  Koen De Bosschere,et al.  On the Effectiveness of Source Code Transformations for Binary Obfuscation , 2006, Software Engineering Research and Practice.

[34]  Roberto Giacobazzi,et al.  Analyzing program dependencies for malware detection , 2014, PPREW'14.

[35]  Hajnal Andréka,et al.  On Residuated Approximations , 1988, Categorial Methods in Computer Science.

[36]  David W. Binkley,et al.  Interprocedural slicing using dependence graphs , 1988, SIGP.

[37]  Roberto Giacobazzi,et al.  Making Abstract Interpretation Incomplete: Modeling the Potency of Obfuscation , 2012, SAS.

[38]  Damiano Zanardini,et al.  Abstract Program Slicing , 2016, ACM Trans. Comput. Log..

[39]  Stephen Drape,et al.  Specifying Imperative Data Obfuscations , 2007, ISC.