Computer Science and Information Systems

5 downloads 261841 Views 450KB Size Report
1 Dept. of Computer Science, DanNooN University. Yongin, Korea ... programmers illegally copies and distributes copyrighted software over online ... software (illegal programs) on OSP and P2P networNs, this paper proposes a new ..... degree in Computer Engineering from Seoul National University in 1991 and 1993,.
&RPSXWHU6FLHQFHDQG,QIRUPDWLRQ6\VWHPV  ± 

'2,&6,6+

A New Detection Scheme of Software Copyright Infringement using Software Birthmark on Windows Systems @G\QDPLFZKROHSURJUDPSDWK :33 EDVHG ELUWKPDUN >@ DQG G\QDPLF $3,EDVHG ELUWKPDUN >@ DUH QRW UHVLOLHQW WR VHPDQWLFV SUHVHUYLQJREIXVFDWLRQDWWDFNVVXFKDVRXWOLQLQJDQGRUGHULQJWUDQVIRUPDWLRQ>@$OVR QRQHRIWKHH[LVWLQJVWDWLFELUWKPDUNVKDVEHHQHYDOXDWHGRQODUJHVFDOHSURJUDPV :HSURSRVHDQHZVRIWZDUHELUWKPDUNEDVHGRQWKHQXPEHUDQGQDPHVRI Dynamic Link Libraries '//V  DQG Application Programming Interfaces $3,V  XVHG LQ :LQGRZVDSSOLFDWLRQV 7KLVELUWKPDUNFDQEHXVHGWRGHWHFWWKHREIXVFDWHG0LFURVRIW:LQGRZVDSSOLFDWLRQV LQFOXGLQJ ODUJHVFDOH SURJUDPV DQG FRQVHTXHQWO\ WR GHWHFW LOOHJDO GLVWULEXWLRQ RI FRS\ULJKWHGVRIWZDUHRYHU263DQG33QHWZRUNV:LQGRZVH[HFXWDEOHSURJUDPVKDYH Portable Executable 3(  IRUPDW DQG WKHLU '// DQG $3, LQIRUPDWLRQ LV VWRUHG LQ D VHFWLRQRI3(Import Address Table ,$7 )RUHDFKDSSOLFDWLRQSURJUDPWKHQXPEHU DQG QDPHV RI '//V DQG $3,V $3, FDOO VHTXHQFH DQG D KDVK YDOXH IRU $3, FDOO VHTXHQFH FDQ EH LQKHUHQW WR HDFK SURJUDP DQG FDQ EH XVHG DV D XQLTXH ELUWKPDUN $FFRUGLQJ WR WKH FKDUDFWHULVWLFV RI WKH QXPEHU DQG QDPHV RI '//V DQG $3,V DSSOLFDWLRQ SURJUDPV FDQ EH JURXSHG LQWR VHYHUDO FDWHJRULHV )WS FOLHQW 7H[W HGLWRU 0HGLD SOD\HU ,PDJH YLHZHU &RPSUHVVLRQ WRRO 0HVVHQJHU &G WRRO SS HWF $ FDWHJRUL]DWLRQV\VWHPVSHHGVXSVHDUFKRULGHQWLILFDWLRQSURFHVV ,QWKLVSDSHUZH KDYH ILUVWFRQVWUXFWDELUWKPDUNGDWDEDVH '% ZKLFKFRQWDLQVWKH QXPEHU DQG QDPHV RI '//V DQG $3,V FDWHJRU\ LQIRUPDWLRQ HDFK KDVK YDOXH RI $3, VHTXHQFHRIDSURJUDPDQGWKHLQIRUPDWLRQLQGLFDWLQJWKDWDFRUUHVSRQGLQJSURJUDPLV FRPPHUFLDO VRIWZDUH RU QRW :KHQHYHU D SURJUDP pi LV XSORDGHG RU GRZQORDGHG RQ



$1HZ'HWHFWLRQ6FKHPHRI6RIWZDUH&RS\ULJKW,QIULQJHPHQW

263RU33QHWZRUNVWKHLGHQWLILFDWLRQSURFHVVRIWKHSURJUDP FRQVLVWVRIIRXUVWHSV  &ODVVLI\LQJWKHpiLQWRDFDWHJRU\  ,QVSHFWLQJWKHQDPHVRI'//VDQGQXPEHURI $3,VRIWKHpiWDUJHWLQJRQO\SURJUDPVFODVVLILHGLQWKHVDPHFDWHJRU\  &RPSXWLQJD KDVKYDOXHXVLQJWKHVHTXHQFHRI$3,FDOOVRIWKHpiDQGFRPSDULQJLWZLWKKDVKYDOXHVRI SURJUDPVZLWKLQWKHLGHQWLILHGFDWHJRU\DQG  ,QFDVH WKDW WKH FDWHJRUL]DWLRQ LQ VWHS  LVIDLOHGDQGWKHQWKHLGHQWLILFDWLRQLQVWHS  LVIDLOHGWRRFRPSDULQJWKHKDVKYDOXH RIWKHpiZLWKWKHKDVKYDOXHVRIDOOSURJUDPVLQWKHHQWLUH'%,IWKHLGHQWLILHGSURJUDP LVFRPPHUFLDOXSORDGRUGRZQORDGLVQRWSHUPLWWHG 7KHUHVWRIWKHSDSHULVRUJDQL]HGDVIROORZV6HFWLRQRXWOLQHVWKHEDFNJURXQGDQG UHODWHG ZRUN 6HFWLRQ  GHVFULEHV WKH SURSRVHG VRIWZDUH ELUWKPDUN ,Q 6HFWLRQ  ZH SUHVHQW W\SLFDO VFHQDULR DQG GHWDLOHG VWHSV IRU LGHQWLI\LQJ DQG ILOWHULQJ FRS\ULJKW LQIULQJHPHQW VRIWZDUH 6HFWLRQ  SUHVHQWV WKH H[SHULPHQW UHVXOWV DQG ILQDOO\ ZH VXPPDUL]HRXUFRQFOXVLRQVDQGGHVFULEHIXWXUHZRUN

2.

Background and Related Work

,Q WKLV VHFWLRQ ZH JLYH DQ RYHUYLHZ RQ ,PSRUW $GGUHVV 7DEOH ,$7  RI WKH 3RUWDEOH ([HFXWDEOH 3( RQ0LFURVRIW:LQGRZV7KH3(LVWKHIRUPDWRIDQH[HFXWDEOHELQDU\ RQ:LQGRZV26:HDOVRH[SODLQ0'KDVKDOJRULWKPDQGYDULRXVVRIWZDUHELUWKPDUN VFKHPHV

2.1.

Import Address Table

0LFURVRIW :LQGRZV RSHUDWLQJ V\VWHPV XVH WKH 3( IRUPDW IRU H[HFXWDEOH ILOHV REMHFW FRGH DQG '//V >@ 7KH 3( IRUPDW FRQWDLQV G\QDPLF OLEUDU\ UHIHUHQFHV IRU OLQNLQJ $3,H[SRUWDQGLPSRUWWDEOHVUHVRXUFHPDQDJHPHQWGDWDDQGWKUHDGORFDOVWRUDJH 7/6  GDWD$3(ILOHFRQVLVWVRIDIHZKHDGHUVDQGVHFWLRQVWKDWWHOOWKHG\QDPLFOLQNHUKRZWR PDSWKHILOHLQWRPHPRU\ :KHQ D SURJUDP LV ORDGHG WKH :LQGRZV ORDGHU ORDGV DOO WKH '//V WKH DSSOLFDWLRQ XVHVDQGPDSVWKHPLQWRWKHSURFHVVDGGUHVVVSDFH$'//LVVLPSO\DILOHWKDWFRQWDLQV RQH RU PRUH SUHFRPSLOHG IXQFWLRQV 7KDW LV HDFK '// FRQWDLQV SUHFRPSLOHG LPSOHPHQWDWLRQ FRGH IRU $3, IXQFWLRQV 7KH H[HFXWDEOH ILOH OLVWV DOO WKH IXQFWLRQV LW UHTXLUHV IURP HDFK '// 7KLV ORDGLQJ DQG MRLQLQJ LV DFFRPSOLVKHG E\ XVLQJ WKH ,$7 7KH,$7LVDWDEOHRIIXQFWLRQSRLQWHUVILOOHGLQE\WKH:LQGRZVORDGHUDVWKH'//VDUH ORDGHG 7KH,$7LVDORRNXSWDEOHZKHQWKHDSSOLFDWLRQLVFDOOLQJDIXQFWLRQIURPDGLIIHUHQW PRGXOH,WFDQEHLQWKHIRUPRIERWKLPSRUWE\RUGLQDODQGLPSRUWE\QDPH>@7KH ,$7RID3(ILOHLVXVHGWRVWRUH YLUWXDODGGUHVVHVRI IXQFWLRQV WKDW DUH LPSRUWHG IURP H[WHUQDO3(ILOHV)URPWKH,$7ZHFDQREWDLQWKHIHDWXUHLQIRUPDWLRQRIWKHSURJUDP VXFK DV WKH QXPEHU RI '//V WKH QDPHV RI '//V DQG WKH QDPHV RI $3, IXQFWLRQV LQ HDFK'// 



@ 7DPDGD HW DO >@ SURSRVHG IRXU W\SHV RI VWDWLF ELUWKPDUN FRQVWDQW YDOXHV LQ ILHOG YDULDEOHVVHTXHQFHRIPHWKRGFDOOVLQKHULWDQFHVWUXFWXUHDQGXVHGFODVVHV$OOWKHIRXU W\SHV DUH YXOQHUDEOH WR REIXVFDWLRQ WHFKQLTXHV VXFK DV FRGH UHPRYDO RU VSOLWWLQJ RI YDULDEOHV >@ ,Q DGGLWLRQ WKHLU WHFKQLTXH QHHGV WR DFFHVV WKH VRXUFH FRGH DQG RQO\ ZRUNVIRUDQREMHFWRULHQWHGSURJUDPPLQJODQJXDJHVXFKDV-DYD 0\OHV DQG &ROOEHUJ SURSRVHG .*UDPEDVHG ELUWKPDUN D VWDWLF WHFKQLTXH ZKLFK XQLTXHO\ LGHQWLILHV D SURJUDP WKURXJK LQVWUXFWLRQ VHTXHQFHV >@ ,QVWUXFWLRQ RSFRGH  VHTXHQFHVRIOHQJWKNDUHH[WUDFWHGIURPDSURJUDPDQGNJUDPWHFKQLTXHVZKLFKZHUH XVHGWRGHWHFWWKHVLPLODULW\RIGRFXPHQWV>@DUHXVHGIRUWKHRSFRGHVHTXHQFH7KHN JUDP VWDWLF ELUWKPDUN LV VWLOO IUDJLOH WR VRPH REIXVFDWLRQ PHWKRGV VXFK DV VWDWHPHQW UHRUGHULQJLQYDOLGLQVWUXFWLRQLQVHUWLRQDQGFRPSLOHURSWLPL]DWLRQ



$1HZ'HWHFWLRQ6FKHPHRI6RIWZDUH&RS\ULJKW,QIULQJHPHQW

0\OHV DQG &ROOEHUJ SUHVHQWHG DQRWKHU G\QDPLF ELUWKPDUN FDOOHG D ZKROH SURJUDP SDWK :33 DQGHYDOXDWHGLWVSHUIRUPDQFHRQD-DYDSURJUDP>@:33LVRULJLQDOO\ XVHGWRUHSUHVHQWWKHG\QDPLFFRQWUROIORZJUDSKV '&)*V RIDSURJUDP,WFROOHFWVDOO WKHFRPSDFW'&)*VDQGUHJDUGVWKHPDVDSURJUDP¶VELUWKPDUNV+RZHYHUD:33PD\ QRWZRUNIRUODUJHVFDOHSURJUDPVEHFDXVHRIWKHRYHUZKHOPLQJYROXPHRI:33WUDFHV $OVRLWLVYXOQHUDEOHWRSURJUDPRSWLPL]DWLRQVXFKDVORRSWUDQVIRUPDWLRQVDQGLQOLQH IXQFWLRQV 7DPDGD HW DO >@ LQWURGXFHG WZR W\SHV RI G\QDPLF ELUWKPDUN IRU :LQGRZV DSSOLFDWLRQV VHTXHQFH RI $3, IXQFWLRQ FDOOV DQG IUHTXHQF\ RI $3, IXQFWLRQ FDOOV 7KH VHTXHQFH DQGIUHTXHQF\RI :LQGRZV $3, FDOOV DUH UHFRUGHG GXULQJ WKH H[HFXWLRQ RI D SURJUDP 6KXOHU DQG 'DOOPHLHU >@ SUHVHQWHG D G\QDPLF ELUWKPDUN EDVHG RQ WKH H[WUDFWLRQRI$3,FDOOVHTXHQFHVHWVGXULQJSURJUDPH[HFXWLRQ$3,ELUWKPDUNVDUHPRUH UREXVW WR REIXVFDWLRQ WKDQ :33 ELUWKPDUNV >@ +RZHYHU G\QDPLF ELUWKPDUNV QHHG SURJUDPH[HFXWLRQVZKLFKDUHGHSHQGHQWRQXVHULQWHUDFWLRQVLQSXWVDQGHQYLURQPHQWV :DQJ HW DO >@ SURSRVHG WZR W\SHV RI V\VWHP FDOO ELUWKPDUN V\VWHP FDOO VKRUW VHTXHQFH ELUWKPDUN DQG LQSXWGHSHQGHQW V\VWHP FDOO VXEVHTXHQFH ELUWKPDUN 6\VWHP FDOOEDVHG ELUWKPDUNV FDQ EH SODWIRUPLQGHSHQGHQW DQG DUH PRUH UREXVW WR FRXQWHU DWWDFNVWKDQ$3,EDVHGRQHV7KH\DOVRQHHGDSURJUDPH[HFXWLRQ0RUHRYHUWKHUHDUH QRHDV\ZD\VWRUHFRUGV\VWHPFDOOWUDFHVRIHDFKDSSOLFDWLRQGXULQJSURJUDPH[HFXWLRQ RQ0LFURVRIW:LQGRZVV\VWHPV &KRLHWDO>@VXJJHVWHGDVWDWLF$3,ELUWKPDUNIRU:LQGRZV7KHLUELUWKPDUNLVDVHW RI SRVVLEOH $3, FDOOV ZKLFK DUH VWDWLFDOO\ H[WUDFWHG E\ DQDO\]LQJ GLVDVVHPEOHG FRGH 7KH\GLGQRWXVH'//LQIRUPDWLRQZKLFKFDQEHHDVLO\REWDLQHGIURPWKH,$7 ,Q RXU SUHYLRXV ZRUN >@ ZH KDYH SURSRVHG WKH VLPLODU VRIWZDUH ELUWKPDUN WR RQH SURSRVHG LQ WKLV SDSHU LQ RUGHU WR LGHQWLI\ HDFK SURJUDP +RZHYHU WKH SUHYLRXV VRIWZDUHELUWKPDUNGLGQRWFRQVLGHUWKHVHTXHQFHRI$3,FDOOVDQGLWVKDVKYDOXHWKXV KDG VRPH OLPLWDWLRQ WR HIILFLHQWO\ LGHQWLI\ VRPH SURJUDPV RI GLIIHUHQW YHUVLRQV ,Q DGGLWLRQRXUSUHYLRXVZRUNGLGQRWXVHVRIWZDUHFODVVLILFDWLRQDQGWKHQKDGWRFRPSDUH WKHELUWKPDUNRIDJLYHQSURJUDPZLWKDOOELUWKPDUNVLQDELUWKPDUNGDWDEDVHWKURXJKWKH IRXUVWHSV,QWKLVSDSHUZH LQWURGXFH  FODVVLILFDWLRQVFKHPH WR JURXS VRPH VLPLODU SURJUDPV LQWR D VDPH FDWHJRU\ DQG   $3, FDOO VHTXHQFH RI D SURJUDP DQG LWV KDVK YDOXH &XUUHQW ELUWKPDUNV DUH OLPLWHG LQ WKHLU FDSDELOLWLHV VRPH VROXWLRQV DUH QRW VWURQJ HQRXJK WR DGHTXDWHO\ SUHYHQW VRIWZDUH WKHIW VRPH FDXVH VLJQLILFDQW SHUIRUPDQFH GHJUDGDWLRQ IRU ODUJHVFDOH SURJUDPV DQG VRPH QHHG SURJUDP H[HFXWLRQ RU ZRUN RQO\ IRU-DYDSURJUDPV 

3.

The Proposed Software Birthmark

7KHSURSRVHGVRIWZDUHELUWKPDUNLQFOXGHVWKHIROORZLQJIHDWXUHV )LJ   QXPEHURI'//VDQGWKHLUQDPHV  QXPEHURI$3,VDQGWKHLUQDPHV  VHTXHQFHRI$3,FDOOV