This research aimed at developing a theoretical framework to predict the next obfuscation (or deobfuscation) move of the adversary, with the intent of making cyber defense proactive. More specifically, the goal was to understand the relationship between obfuscation and deobfuscation techniques employed in malware offense and defense. The strategy was to build upon previous work of Giacobazzi an...

Spam deobfuscation is a processing to detect obfuscated words appeared in spam emails and to convert them back to the original words for correct recognition. Lexicon tree hidden Markov model (LTHMM) was recently shown to be useful in spam deobfuscation. However, LT-HMM suffers from a huge number of states, which is not desirable for practical applications. In this paper we present a complexity-...

Circuit obfuscation is a recently proposed defense mechanism to protect the intellectual property (IP) of digital integrated circuits (ICs) from reverse engineering. There have been effective schemes, such as satisfiability (SAT)-checking based attacks that can potentially decrypt obfuscated circuits, which called deobfuscation. Deobfuscation runtime could be days or years, depending on layouts...

Android obfuscation techniques include not only classic code that were adapted to Android, but also methods target the platform specifically. This work examines status-quo of obfuscation, detection and deobfuscation. Specifically, it first summarizes approaches are commonly used by app developers for optimization, protect their software against theft tampering frequently misused malware circumv...

With the improvement of software copyright protection awareness, code obfuscation technology plays a crucial role in protecting key segments. As becomes more and complex diverse, it has spawned large number malware variants, which make easy to evade detection anti-virus software. Malicious mainly depends on binary similarity analysis. However, existing analysis technologies are difficult deal w...