随机森林在程序分支混淆中的应用  

Branch Obfuscation Using Random Forest

作　　者：陈喆 贾春福 宗楠[1] 郑万通 CHEN Zhe;JIA Chun-fu;ZONG Nan;ZHENG Wan-tong(College of Computer and Control Engineering,Nankai University,Tianjin 300350,China;Information Security Evaluation Center of Civil Aviation,Civil Aviation University of China,Tianjin 300300,China;Key Lab on High Trusted Information System in Hebei Province,Baoding,Hebei 071002,China)

机构地区：[1]南开大学计算机与控制工程学院,天津300350 [2]中国民航大学信息安全测评中心,天津300300 [3]河北省高可信信息系统重点实验室,河北保定071002

出　　处：《电子学报》2018年第10期2458-2466,共9页Acta Electronica Sinica

基　　金：国家重点基础研究发展计划(No.2013CB834204);国家自然科学基金(No.61772291);天津市自然科学基金(No.17JCZDJC30500);中国民航大学信息安全测评中心开放课题(No.CAAC-ISECCA-201702)

摘　　要：程序中的路径信息在程序执行过程中会被动态地泄露,基于路径敏感技术的逆向工程可自动地收集程序中的条件跳转指令,从而理解程序的内部逻辑.为了缓解路径信息泄露,提出了一种基于随机森林的路径分支混淆方法,将逆向分析路径分支信息的难度等价于抽取随机森林规则的难度.鉴于随机森林分类器可被视为一种黑盒,其内部规则难以被提取且分类过程与路径分支行为相似,因此经过特殊训练的随机森林可以在功能上替代路径分支.将该方法部署于SPECint-2006标准测试集中的6个程序进行实验,实验结果表明该混淆方法有效地保护了路径分支信息,引发的额外开销较低,具有实用性.Reverse engineering can automatically collect the path information which has been leaked in program run-time,and then reveal the internal logics of programs.To mitigate path information leaking,this paper proposes a novel path obfuscator to combat state-of-art reverse engineering by using random forest.The difficulty of reversing the obfuscated branch is equivalent to extracting rules from random forests.Since random forests can be regarded as black-box and the categorizing process has high similarity with the behavior of path branch,so the specially trained random forest can realize the functionality of path branch.The proposed obfuscator had been deployed on six programs from SPECint-2006 benchmarks.The experimental results show that our method has significantly increased the computational cost of reverse engineering,and the introduced overhead is acceptable.

关 键 词：代码混淆 逆向工程 随机森林 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]