Publication Type

Conference Proceeding Article

Version

publishedVersion

Publication Date

9-2014

Abstract

Concolic testing is widely regarded as the state-of-the-art technique in dynamic discovering and analyzing trigger-based behavior in software programs. It uses symbolic execution and an automatic theorem prover to generate new concrete test cases to maximize code coverage for scenarios like software verification and malware analysis. While malicious developers usually try their best to hide malicious executions, there are also circumstances in which legitimate reasons are presented for a program to conceal trigger-based conditions and the corresponding behavior, which leads to the demand of control flow obfuscation techniques. We propose a novel control flow obfuscation design based on the incomprehensibility of artificial neural networks to fight against reverse engineering tools including concolic testing. By training neural networks to simulate conditional behaviors of a program, we manage to precisely replace essential points of a program’s control flow with neural network computations. Evaluations show that since the complexity of extracting rules from trained neural networks easily goes beyond the capability of program analysis tools, it is infeasible to apply concolic testing on code obfuscated with our method. Our method also incorporates only basic integer operations and simple loops, thus can be hard to be distinguished from regular programs.

Keywords

Software obfuscation, malware analysis, reverse engineering, concolic testing, neural network

Discipline

Information Security

Research Areas

Cybersecurity

Publication

International Conference on Security and Privacy in Communication Networks: 10th International ICST Conference, SecureComm 2014, Beijing, China, September 24-26, 2014, Revised Selected Papers, Part I

Volume

152

First Page

287

Last Page

304

ISBN

9783319238289

Identifier

10.1007/978-3-319-23829-6_21

Publisher

Springer Verlag

City or Country

New York

Additional URL

http://dx.doi.org/10.1007/978-3-319-23829-6_21

Download

Share

COinS