Identifying Obfuscated Code through Graph-Based Semantic Analysis of Binary Code
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2025
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866916671502942208 |
|---|---|
| author | Cohen, Roxane David, Robin Yger, Florian Rossi, Fabrice |
| author_facet | Cohen, Roxane David, Robin Yger, Florian Rossi, Fabrice |
| contents | Protecting sensitive program content is a critical issue in various situations, ranging from legitimate use cases to unethical contexts. Obfuscation is one of the most used techniques to ensure such protection. Consequently, attackers must first detect and characterize obfuscation before launching any attack against it. This paper investigates the problem of function-level obfuscation detection using graph-based approaches, comparing algorithms, from elementary baselines to promising techniques like GNN (Graph Neural Networks), on different feature choices. We consider various obfuscation types and obfuscators, resulting in two complex datasets. Our findings demonstrate that GNNs need meaningful features that capture aspects of function semantics to outperform baselines. Our approach shows satisfactory results, especially in a challenging 11-class classification task and in a practical malware analysis example. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2504_01481 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Identifying Obfuscated Code through Graph-Based Semantic Analysis of Binary Code Cohen, Roxane David, Robin Yger, Florian Rossi, Fabrice Cryptography and Security Machine Learning Protecting sensitive program content is a critical issue in various situations, ranging from legitimate use cases to unethical contexts. Obfuscation is one of the most used techniques to ensure such protection. Consequently, attackers must first detect and characterize obfuscation before launching any attack against it. This paper investigates the problem of function-level obfuscation detection using graph-based approaches, comparing algorithms, from elementary baselines to promising techniques like GNN (Graph Neural Networks), on different feature choices. We consider various obfuscation types and obfuscators, resulting in two complex datasets. Our findings demonstrate that GNNs need meaningful features that capture aspects of function semantics to outperform baselines. Our approach shows satisfactory results, especially in a challenging 11-class classification task and in a practical malware analysis example. |
| title | Identifying Obfuscated Code through Graph-Based Semantic Analysis of Binary Code |
| topic | Cryptography and Security Machine Learning |
| url | https://arxiv.org/abs/2504.01481 |