Grammar-based transformations: attack and defence. Issue 2 (3rd June 2014)

• Record Type: Journal Article
• Authors: Veniamin Ginodman, Ms. Natalya Obelets, Mr Ram Herkanaidu, Mr; Repel, Dusan; Stengel, Ingo
• Is Part Of: Information management & computer security. Volume 22:Issue 2(2014)
• Page Start: 141
• Page End: 154
• Publication Date: 2014-06-03
• Subjects: Information technology -- Management -- Periodicals; Management information systems -- Periodicals; Computer security -- Periodicals; 658.05
• DOI: 10.1108/IMCS-09-2013-0071
• Languages: English
• ISSNs: 0968-5227

Abstract

<abstract> <title> <x content-type="archive" xml:space="preserve">Abstract</x> </title> <sec> <title content-type="abstract-heading">Purpose</title> <p> – This research aims to propose an attack that de-obfuscates codes by exploiting the properties of context-free grammars since it is important to understand the strength of obfuscation provided by context-free grammar-based obfuscators. In addition, the possibility of automatically generated transformations is explored. </p> </sec> <sec> <title content-type="abstract-heading">Design/methodology/approach</title> <p> – As part of our empirical investigation, a development environment for obfuscating transformations is built. The tool is used to simulate a context-free obfuscator and to devise ways of reversing such transformations. Furthermore, a theoretical investigation of subset grammars and subset languages is carried out. </p> </sec> <sec> <title content-type="abstract-heading">Findings</title> <p> – It is concluded that context-free grammar-based obfuscators provide limited levels of protection. Nevertheless, their application is appropriate when combined with other obfuscating techniques. </p> </sec> <sec> <title content-type="abstract-heading">Research limitations/implications</title> <p> – The algorithms behave as expected on a limited number of test samples. Further work is required to increase their practicality and to establish their average reliability. </p> </sec> <sec> <title content-type="abstract-heading">Originality/value</title> <p> – This research shows how a frequency analysis attack can threaten the security of code scrambled by context-free grammar-based obfuscators.</p> </sec> </abstract>