一種基于程序執(zhí)行時(shí)間量化分析的軟件水印方法

張穎君; 陳愷; 鮑旭華

doi:10.11999/JEIT190850

一種基于程序執(zhí)行時(shí)間量化分析的軟件水印方法

doi: 10.11999/JEIT190850 cstr: 32379.14.JEIT190850

1.
中國科學(xué)院軟件研究所可信計(jì)算與信息保障實(shí)驗(yàn)室北京 100190
2.
中國科學(xué)院信息工程研究所信息安全國家重點(diǎn)實(shí)驗(yàn)室北京 100093
3.
網(wǎng)神信息技術(shù)(北京)股份有限公司北京 100015

基金項(xiàng)目: 國家重點(diǎn)研發(fā)計(jì)劃項(xiàng)目(2016QY04W0805)，國家自然科學(xué)基金(U1836211)，大數(shù)據(jù)協(xié)同安全國家工程實(shí)驗(yàn)室開放課題

詳細(xì)信息

作者簡介:
張穎君：女，1982年生，副研究員，主要研究方向?yàn)榘踩珳y(cè)評(píng)、系統(tǒng)安全

陳愷：男，1982年生，研究員，主要研究方向?yàn)橄到y(tǒng)安全、人工智能安全

鮑旭華：男，1977年生，高級(jí)工程師，主要研究方向?yàn)樾畔踩?/p>

通訊作者:
鮑旭華　xuhua.bao@outlook.com

中圖分類號(hào): TP309
計(jì)量
- 文章訪問數(shù): 1852
- HTML全文瀏覽量: 730
- PDF下載量: 127
- 被引次數(shù): 0
出版歷程
- 收稿日期: 2019-11-01
- 修回日期: 2020-03-20
- 網(wǎng)絡(luò)出版日期: 2020-07-08
- 刊出日期: 2020-08-18

A Software Watermarking Method Based on Program Execution Time

1.
Trusted Computing and Information Assureance Laboratory, Institute of Software, Chinese Academy of Sciences, Beijing 100190, China
2.
State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China
3.
Legendsec Information Technology(Beijing) Inc, Beijing 100015, China

Funds: The National Key Research and Development Program of China(2016QY04W0805), The National Natural Science Foundation of China (U1836211), The Open Project of National Engineering Laboratory of Big Data Collaborative Security

摘要

摘要: 當(dāng)前，應(yīng)用軟件面臨的重要問題是不法分子通過軟件剽竊、重打包等技術(shù)，將惡意負(fù)載或廣告加載到合法應(yīng)用軟件中，并形成新軟件進(jìn)行發(fā)布，給用戶和應(yīng)用軟件作者的合法權(quán)益帶來威脅。為了實(shí)現(xiàn)對(duì)應(yīng)用軟件剽竊、重打包等安全風(fēng)險(xiǎn)的測(cè)評(píng)，該文提出一種基于程序執(zhí)行時(shí)間量化分析的軟件水印方法(SW_PET)。通過生成多種相互抵消功能的操作組，實(shí)現(xiàn)對(duì)水印信息的時(shí)間化編碼，并植入應(yīng)用軟件中；在檢測(cè)過程中，需要提取相應(yīng)的水印信息，對(duì)照之前的時(shí)間編碼對(duì)應(yīng)的原始水印，比較不同操作的執(zhí)行時(shí)間，判斷水印相似度，進(jìn)而判別原始水印的存在性，完成應(yīng)用軟件合法性的判斷。該方法也可以與其它類型的水印信息相結(jié)合，增強(qiáng)水印的魯棒性。最后，通過搭建仿真模擬器，實(shí)現(xiàn)對(duì)不同應(yīng)用軟件水印信息的比較和判斷，驗(yàn)證該方法的有效性。
- 軟件水印 /
- 程序執(zhí)行 /
- 水印編碼
Abstract: Currently, a main problem in software is repackaging or plagiarization, which means attackers can add malicious payloads or advertisements into legitimate APPs through piggybacking, it greatly threatens the users and original developers. In this paper, a novel Software Watermarking method based on Program Execution Time (SW_PET) is proposed. By generating a variety of effect-canceling operations, the watermark information can be encoded into the form of program execution time, and can be embedded into Android APPs. In the detection process, the watermark information is extracted and compared with the original watermark to check whether the APP is repackaged. This method can be combined with other types of watermarks (e.g., picture-based watermarks) in order to enhance the robustness. Finally, the effectiveness of the proposed approach is verified, and the overhead introduced by the watermark is measured, which is demonstrated to be minimal.
- Software watermarking /
- Program execution /
- Watermark encoding

HTML全文

圖 1 基于程序執(zhí)行時(shí)間量化分析的水印方法流程圖

下載: 全尺寸圖片幻燈片

圖 2 程序相關(guān)編碼示例

下載: 全尺寸圖片幻燈片

圖 3 使用原始程序中代碼作為水印示例

下載: 全尺寸圖片幻燈片

表 1 主要操作類型表

操作類型	操作	示例
算術(shù)操作	加法	x = x + y, x = x + C，等
	減法	x = x – y, x = x - C，等
	乘法	x = x × y, x = x × C，等
	除法	x = x / y, x = x / C，等
邏輯操作	邏輯與	x = x && y, x = x && C，等
	邏輯或	x = x \|\| y, x = x \|\| C，等
	邏輯非	x =!x
比特位操作	比特and操作	x = x & y, x = x & C，等
比特位操作	比特or操作	x = x \| y, x = x \| C，等
移位操作	左移位	x = x << y, x = x << C，等
移位操作	右移位	x = x >> y, x = x >> C，等

下載: 導(dǎo)出CSV

表 2 mark的時(shí)間編碼序列

水印字母	操作代碼
m	x = x + y; x = x – y
a	x = x × y; x = x / y
r	x = x + y; x = x – y; x = x × y; x = x / y
k	y = x; x = (x>>2); y = x & 0 × 3; x = (x<<2)\|y

下載: 導(dǎo)出CSV

表 3 mark的時(shí)間編碼序列

水印字母	操作代碼	時(shí)間(μs)
m	x = x + y; x = x – y	2.14
a	x = x × y; x = x / y	4.04
r	x = x + y; x = x – y; x = x × y; x = x / y	7.14
k	y = x; x = (x>>2); y = x & 0x3; x = (x<<2)\|y	6.19

下載: 導(dǎo)出CSV

表 4 典型水印算法安全性比較

水印方法	安全性	隱蔽性	水印容量	復(fù)雜度
DMI^[13]	+	+	+++	+
GTW^[14]	++	++	+++	++
CT^[21]	++	+++	+++	++
AppInk^[2]	+++	+++	+++	++
SW_PET	+++	+++	+++	+

下載: 導(dǎo)出CSV

參考文獻(xiàn)(23)

林迪. 2018年中國App下載量排名全球第一: 占全球50%[EB/OL]. https://www.sohu.com/a/289551518_162522, 2019.

ZHOU Wu, ZHANG Xinwen, and JIANG Xuxian. AppInk: Watermarking android apps for repackaging deterrence[C]. The 8th ACM SIGSAC Symposium on Information, Computer and Communications Security. Hangzhou, China, 2013: 1–12. doi: 10.1145/2484313.2484315.

ZHOU Wu, ZHOU Yajin, JIANG Xuxian, et al. Detecting repackaged smartphone applications in third-party android marketplaces[C]. The 2nd ACM Conference on Data and Application Security and Privacy. San Antonio, United States, 2012: 317–326. doi: 10.1145/2133601.2133640.

Arxan Technologies. State of security in the App Economy: Mobile apps under attack[EB/OL]. http://www.arxan.com/assets/1/7/state-of-security-appeconomy.pdf, 2012.

CHEN Kai, ZHANG Yingjun, and LIU Peng. Leveraging information asymmetry to transform android apps into self-defending code against repackaging attacks[J]. IEEE Transactions on Mobile Computing, 2018, 17(8): 1879–1893. doi: 10.1109/TMC.2017.2782249

CHEN Kai, LIU Peng, and ZHANG Yingjun. Achieving accuracy and scalability simultaneously in detecting application clones on android markets[C]. The 36th International Conference on Software Engineering. Hyderabad, India, 2014: 175–186. doi: 10.1145/2568225.2568286.

CRUSSELL J, GIBLER C, and CHEN Hao. AnDarwin: Scalable detection of semantically similar android applications[C]. The 18th European Symposium on Research in Computer Security on Computer Security. Egham, UK, 2013: 182–199. doi: 10.1007/978-3-642-40203-6_11.

Guardsquare. Proguar[EB/OL]. http://proguard.sourceforge.net/, 2013.

Guardsquare. A specialized optimizer and obfuscator for android[EB/OL]. http://www.saikoa.com/dexguard, 2013.

陳明奇, 鈕心忻, 楊義先. 數(shù)字水印的攻擊方法[J]. 電子與信息學(xué)報(bào), 2001, 23(7): 705–711.

CHEN Mingqi, NIU Xinyi, and YANG Yixian. The attack methods of digital watermarking[J]. Journal of Electronics &Information Technology, 2001, 23(7): 705–711.

毛瓊, 陳明奇, 夏光升, 等. 安全數(shù)字水印體系的研究[J]. 電子與信息學(xué)報(bào), 2001, 23(9): 833–840.

MAO Qiong, CHEN Mingqi, XIA Guangsheng, et al. The research of secure digital watermarking architecture[J]. Journal of Electronics &Information Technology, 2001, 23(9): 833–840.

HAMILTON J and DANICIC S. A survey of static software watermarking[C]. 2011 World Congress on Internet Security. London, UK, 2011: 100–107. doi: 10.1109/worldcis17046.2011.5749891.

MONDEN A, IIDA H, MATSUMOTO K, et al. A practical method for watermarking java programs[C]. The 24th Annual International Computer Software and Applications Conference. Taipei, China, 2000: 191–197. doi: 10.1109/CMPSAC.2000.884716.

VENKATESAN R, VAZIRANI V, and SINHA S. A graph theoretic approach to software watermarking[C]. The 4th International Workshop on Information Hiding. Pittsburgh, USA, 2001: 157–168. doi: 10.1007/3-540-45496-9_12.

COUSOT P and COUSOT R. An abstract interpretation-based framework for software watermarking[C]. The 31st ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages. Venice, Italy, 2004: 173–185. doi: 10.1145/964001.964016.

NAGRA J and THOMBORSON C. Threading software watermarks[C]. The 6th International Workshop on Information Hiding. Toronto, Canada, 2004: 208–223. doi: 10.1007/978-3-540-30114-1_15.

COLLBERG C, HUNTWORK A, CARTER E, et al. More on graph theoretic software watermarks: Implementation, analysis, and attacks[J]. Information and Software Technology, 2009, 51(1): 56–67. doi: 10.1016/j.infsof.2008.09.016

COLLBERG C, CARTER E, DEBRAY S, et al. Dynamic path-based software watermarking[J]. ACM Sigplan Notices, 2004, 39(6): 107–118. doi: 10.1145/996893.996856

COLLBERG C, CARTER E, DEBRAY S, et al. Dynamic path-based software watermarking[C]. The 2004 ACM SIGPLAN Conference on Programming Language Design and Implementation, Washington, USA, 2004: 107–118. doi: 10.1145/996841.996856.

ZENG Lingling, REN Wei, LEI Min, et al. DroidMark: A lightweight android text and space watermark scheme based on semantics of XML and DEX[C]. The 5th International Conference on Emerging Internetworking. Wuhan, China, 2017: 756–766. doi: 10.1007/978-3-319-59463-7_75.

COLLBERG C and THOMBORSON C. Software watermarking: Models and dynamic embedding[C]. The 26th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages. San Antonio, USA, 1999: 311–324. doi: 10.1145/292540.292569.

ZHANG Yingjun and CHEN Kai. AppMark: A picture-based watermark for android apps[C]. The 8th International Conference on Software Security and Reliability (SERE). San Francisco, USA, 2014: 58–67. doi: 10.1109/SERE.2014.19.

王葉茂, 車生兵. 軟件水印及其研究現(xiàn)狀概述[J]. 計(jì)算機(jī)應(yīng)用與軟件, 2015, 32(4): 6–10. doi: 10.3969/j.issn.1000-386x.2015.04.002

WANG Yemao and CHE Shengbing. Summary on software watermarking and its research progress[J]. Computer Applications and Software, 2015, 32(4): 6–10. doi: 10.3969/j.issn.1000-386x.2015.04.002

相關(guān)文章

施引文獻(xiàn)

資源附件(0)

訪問統(tǒng)計(jì)