基于多层次属性加权的代码混淆有效性量化评估

Quantitative Evaluation for Effectiveness of Code Obfuscation Based on Multi-level Weighted Attributes

为了克服软件保护过程中代码混淆方法选择的偶然性和盲目性,针对代码混淆量化比较和评估困难的问题,提出一种基于多层次属性加权的代码混淆定量评估方法:从攻击者角度出发,采用静态和动态逆向分析手段对混淆前后程序进行分析,量化基于程序属性的评估指标。构建三级层次分析模型,运用专家评分法来比较程序属性之间的重要性,以确定属性权值。在程序属性指标量化值和权值的基础上,运用层次分析法对不同混淆方法进行评估。实验和分析表明,评估方法能够定量地对不同混淆算法的有效性进行比较。

In order to overcome randomness and blindness for choosing code obfuscation algorithms in the process of software protection,in view of the problem that quantitative comparison and evaluation of code obfuscation are difficult,aquantitative evaluation method of obfuscation based on multi-level weighted attributes was proposed.From the aspect of attacker,it uses static and dynamic reverse analysis means to analyze the original and obfuscated programs,and quantifies evaluation index based on program attributes.Three-level hierarchical analysis model is constructed,and expert evaluation method is used to compare the importance of program attributes and determine the weights of program attributes.Based on the evaluation index quantitative values and weights of attributes,analytic hierarchy process is used to evaluate different obfuscation methods.Experiment and analysis show that the method can quantitatively compare the effectiveness of different obfuscation algorithms.