International Journal of
Information and Education Technology

Abstract

Software birthmark is a unique characteristic of program extracted from a program without source code. Through the comparison of original program and modified program, code similarity can be measured. Furthermore, birthmark can be used to measure the similarity of existing program to detect code theft or malware. Software birthmark can be mainly divided into static method and dynamic method. In the related works using dynamic method, birthmark was extracted by using API function name, call frequency, grammar structure, opcode, etc. If birthmark is extracted through API function name or call frequency, resilience can be increased but it could cause false-positive in similarity. In addition, extraction method using grammar structure or opcode could increase similarity but it decreases resilience, thereby causing different extraction result even for program with same structure. This paper proposes a method that can simultaneously satisfy resilience and uniqueness by reflecting unique characteristics while maintaining the meaning of instruction through the categorization according to instruction function and the removal of consecutive duplication for dynamic software birthmark, which will also be verified through experiment.