Login | Register

OBA2: An Onion approach to Binary Code Authorship Attribution

Title:

OBA2: An Onion approach to Binary Code Authorship Attribution

Alrabaee, Saed, Saleem, Noman, Preda, Stere, Wang, Lingyu and Debbabi, Mourad (2014) OBA2: An Onion approach to Binary Code Authorship Attribution. Digital Investigation, 11 (1). S94-S103. ISSN http://dx.doi.org/10.1016/j.diin.2014.03.012

[img]
Preview
Text (application/pdf)
OBA2.pdf - Published Version
Available under License Spectrum Terms of Access.
1MB

Official URL: http://www.journals.elsevier.com/digital-investiga...

Abstract

A critical aspect of malware forensics is authorship analysis. The successful outcome of
such analysis is usually determined by the reverse engineer’s skills and by the volume and
complexity of the code under analysis. To assist reverse engineers in such a tedious and
error-prone task, it is desirable to develop reliable and automated tools for supporting the
practice of malware authorship attribution. In a recent work, machine learning was used to
rank and select syntax-based features such as n-grams and flow graphs. The experimental
results showed that the top ranked features were unique for each author, which was
regarded as an evidence that those features capture the author’s programming styles. In
this paper, however, we show that the uniqueness of features does not necessarily
correspond to authorship. Specifically, our analysis demonstrates that many “unique”
features selected using this method are clearly unrelated to the authors’ programming
styles, for example, unique IDs or random but unique function names generated by the
compiler; furthermore, the overall accuracy is generally unsatisfactory. Motivated by this
discovery, we propose a layered Onion Approach for Binary Authorship Attribution called
OBA2. The novelty of our approach lies in the three complementary layers: preprocessing,
syntax-based attribution, and semantic-based attribution. Experiments show that our
method produces results that not only are more accurate but have a meaningful connection
to the authors’ styles.

Divisions:Concordia University > Gina Cody School of Engineering and Computer Science > Concordia Institute for Information Systems Engineering
Item Type:Article
Refereed:No
Authors:Alrabaee, Saed and Saleem, Noman and Preda, Stere and Wang, Lingyu and Debbabi, Mourad
Journal or Publication:Digital Investigation
Date:May 2014
Funders:
  • Defence Research and Development Canada
ID Code:978598
Deposited By: SAED SALEH HUSS AL-RABAEE
Deposited On:05 May 2014 15:40
Last Modified:18 Jan 2018 17:47
Related URLs:
All items in Spectrum are protected by copyright, with all rights reserved. The use of items is governed by Spectrum's terms of access.

Repository Staff Only: item control page

Downloads per month over past year

Back to top Back to top