Obfuscated code is identifiable by a token-based code clone detection technique. (21st November 2022)

• Record Type: Journal Article
• Authors: Akram, Junaid; Vasan, Danish; Luo, Ping
• Is Part Of: International journal of information and computer security. Volume 19:Number 3/4(2022)
• Page Start: 254
• Page End: 273
• Publication Date: 2022-11-21
• Subjects: obfuscation handling -- code clones -- software security -- malware detection -- Android applications -- code reuse; Computer security -- Periodicals; Information systems management -- Security measures -- Periodicals; Computer networks -- Security measures -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• Languages: English
• ISSNs: 1744-1765

Abstract

Recently, developers use obfuscation techniques to make their code difficult to understand or analyse, especially malware developers. In Android applications, if the application is obfuscated, it is hard to retrieve the exact source code after applying reverse engineering techniques on it. In this paper, we propose an approach which is based on clone detection technique and it can detect obfuscated code in Android applications very efficiently. We perform two experiments on different types of datasets including obfuscated and non-obfuscated application's source code. We successfully detected the obfuscated code of two types, including identifier-renaming and string-encryption with a high accuracy of 95%. A comparative study with other state-of-the-art tools proves the efficiency of our proposed approach. Experimental results show that our approach is reliable, efficient and can be implemented at a large-scale level.