Code flow obfuscation method and device

Abstract

The objective of the present invention is to present a code flow obfuscation technique for obfuscating a code flow of an application, the method comprising: generating an unpredictable and complex obfuscation code block by using artificial intelligence (for example, generative AI); and implementing a configuration of naturally connecting a reference without affecting the code flow of the application during insertion of the obfuscation code block.

Description

Code flow obfuscation method and device

[0001] The present invention relates to a technique for obfuscating the code flow of an application.

[0002] This invention claims the benefit of application No. 10-2024-0045089, filed April 3, 2024, the entire contents of which are incorporated herein by reference for all purposes.

[0003] Security vulnerability analysts use reverse engineering techniques to analyze various security issues.

[0004] Reverse engineering is a technique for finding vulnerabilities by directly analyzing executable files or Java byte codes without the source code of the program or application to determine what functions the program or application performs.

[0005] This type of reverse engineering can be used to find security vulnerabilities and resolve security issues, but it can also be used for malicious purposes, such as finding and attacking security vulnerabilities.

[0006] To counter attacks through reverse engineering, obfuscation technology was developed to make code complex and difficult to understand the code flow.

[0007] Among these obfuscation techniques, the BCG (Bogus Code Generation) technique is a technique that obfuscates the code flow of the application by inserting arbitrary code (aka fake code) into the target application to complicate it.

[0008] Typically, applications focus on reducing the size of executable files by loading only the code necessary for execution. However, the BCG technique, on the other hand, focuses on increasing the analysis target during reverse engineering by adding / inserting fake code that is not necessary for execution.

[0009] In this BCG technique, it is important to eliminate predictable code repetition as much as possible when inserting fake code, so that the code flow by the fake code (aka obfuscated code flow) cannot be analyzed and predicted.

[0010] However, the existing BCG technique has limitations in that it is easy to predict code repetition and the obfuscated code flow can be easily analyzed through the pattern of such code repetition because it inserts fake code in the form of a list of predefined code blocks.

[0011] Taking this into consideration, the present invention proposes a new code flow obfuscation technique that can improve the limitation of the existing BCG technique in which the obfuscated code flow is easy to predict and enhance the unpredictability and complexity of the obfuscated code flow.

[0012] The problem to be solved in the present invention is to provide a code flow obfuscation technique that can enhance the unpredictability and complexity of the obfuscated code flow in obfuscating the code flow of an application.

[0013] A method for obfuscating code flow for an application according to a first aspect of the present invention comprises a generation step of generating a fake method using artificial intelligence; an insertion step of inserting the fake method into the application; and a reference relationship generation step of generating a reference relationship between the fake method and a class within the application into which the fake method is inserted, so that the code flow of the application is obfuscated due to the code flow of the fake method.

[0014] A code flow obfuscation device for an application according to a second aspect of the present invention includes a fake method generation unit that generates a fake method using artificial intelligence; an insertion unit that inserts the fake method into an application; and a reference relationship generation unit that generates a reference relationship between the fake method and a class within the application into which the fake method is inserted, so that the code flow of the application is obfuscated due to the code flow of the fake method.

[0015] According to embodiments of the present invention, a configuration is realized in which artificial intelligence (e.g., generative AI) is utilized to generate unpredictable and complex obfuscated code blocks for obfuscating the code flow of an application, and further, a configuration is realized in which references are naturally connected without affecting the code flow of the application when an obfuscated code block is inserted.

[0016] Accordingly, according to the present invention, it is possible to derive effects of improving the overall obfuscation performance, such as the effect of improving the limitation of easy prediction of obfuscated code flow in the existing BCG technique, and the effect of increasing resistance to code flow analysis through reference connections that do not affect the code flow of the application.

[0017] FIG. 1 is a conceptual diagram illustrating a code flow obfuscation device according to one embodiment of the present invention.

[0018] FIG. 2 is a block diagram illustrating a code flow obfuscation device according to one embodiment of the present invention.

[0019] FIG. 3 is an example diagram illustrating a flow for generating a random code block and generating a fake method in the present invention.

[0020] FIG. 4 is a flowchart illustrating the operation of a code flow obfuscation method according to an embodiment of the present invention.

[0021] Figures 5 and 6, 7 and 8 are exemplary diagrams illustrating a process of creating a fake method and a reference relationship between classes within an application in the present invention.

[0022] The present invention is susceptible to various modifications and embodiments. Specific embodiments are illustrated and described in detail in the drawings. However, this is not intended to limit the present invention to specific embodiments, but rather to encompass all modifications, equivalents, and alternatives falling within the spirit and technical scope of the present invention. Throughout the description of each drawing, similar reference numerals have been used to designate similar components.

[0023] When a component is referred to as being "connected" or "connected" to another component, it should be understood that the connection may be direct or intervening. Conversely, when a component is referred to as being "directly connected" or "connected" to another component, it should be understood that there are no intervening components.

[0024] The terminology used in this application is only used to describe specific embodiments and is not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly indicates otherwise. In this application, it should be understood that the terms "comprise" or "have" indicate the presence of a feature, number, step, operation, component, part, or combination thereof described in the specification, but do not preclude the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0025] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and will not be interpreted in an idealized or overly formal sense unless explicitly defined herein.

[0026] Hereinafter, the present invention will be described with reference to the attached drawings.

[0027] The present invention relates to a technique for obfuscating the code flow of an application.

[0028] Security vulnerability analysts use reverse engineering techniques to analyze various security issues.

[0029] Reverse engineering is a technique for finding vulnerabilities by directly analyzing executable files or Java byte codes without the source code of the program or application to determine what functions the program or application performs.

[0030] This type of reverse engineering can be used to find security vulnerabilities and resolve security issues, but it can also be used for malicious purposes, such as finding and attacking security vulnerabilities.

[0031] To counter attacks through reverse engineering, obfuscation technology was developed to make code complex and difficult to understand the code flow.

[0032] Among these obfuscation techniques, the BCG (Bogus Code Generation) technique is a technique that obfuscates the code flow of the application by inserting arbitrary code (aka fake code) into the target application to complicate it.

[0033] Typically, applications focus on reducing the size of executable files by loading only the code necessary for execution. However, the BCG technique, on the other hand, focuses on increasing the analysis target during reverse engineering by adding / inserting fake code that is not necessary for execution.

[0034] In this BCG technique, it is important to eliminate predictable code repetition as much as possible when inserting fake code, so that the code flow by the fake code (aka obfuscated code flow) cannot be analyzed and predicted.

[0035] In the case of fake code insertion used in the existing BCG technique, the obfuscated code flow is created by inserting fake code in the form of a list of predefined code blocks.

[0036] Accordingly, according to the existing BCG technique, there is a limitation that code repetition is easy to predict and the obfuscated code flow can be easily analyzed through the pattern of such code repetition.

[0037] Taking this into consideration, the present invention proposes a new code flow obfuscation technique that can improve the limitation of the existing BCG technique in which the obfuscated code flow is easy to predict and enhance the unpredictability and complexity of the obfuscated code flow.

[0038] Additionally, if the obfuscated code flow does not create classes and reference relationships within the application, there is a limitation that inserted fake code can be easily extracted through code flow analysis.

[0039] Accordingly, the present invention proposes a new code flow obfuscation technique that can enhance the unpredictability and complexity of obfuscated code flow, and further, can naturally connect references without affecting the code flow of an application.

[0040] Figure 1 conceptually illustrates a code flow obfuscation device according to one embodiment of the present invention.

[0041] As illustrated in FIG. 1, a code flow obfuscation device (100) according to one embodiment of the present invention utilizes artificial intelligence (10) in generating an obfuscated code block.

[0042] Figure 1 illustrates an example of utilizing generative AI (Artificial Intelligence) as artificial intelligence (10).

[0043] That is, the code flow obfuscation device (100) of the present invention realizes a configuration that generates a fake method to be used as an obfuscated code block, i.e., an unpredictable and complex random fake method, by utilizing a generative AI (10).

[0044] In the present invention, a fake method to be used as an obfuscated code block is created, and the names of the obfuscated code block and the fake method can be understood as referring to the same object.

[0045] In addition, the code flow obfuscation device (100) of the present invention realizes a configuration that creates a reference relationship, i.e. a bidirectional reference, without affecting the code flow of the application when a fake method is inserted for the target application (1,..., N) for obfuscating the code flow.

[0046] Below, a specific component that implements the code flow obfuscation technique proposed in the present invention, i.e., the code flow obfuscation device (100), will be described.

[0047] FIG. 2 shows the functional configuration of a code flow obfuscation device (100) according to one embodiment of the present invention.

[0048] The code flow obfuscation device (100) of the present invention includes a fake method generation unit (110) that generates a fake method using artificial intelligence (hereinafter, generative AI (10)), an insertion unit (120) that inserts the fake method into an application, and a reference relationship generation unit (130) that generates a reference relationship between the fake method and a class within the application into which the fake method is inserted, so that the code flow of the application is obfuscated due to the code flow of the fake method.

[0049] In another embodiment, the code flow obfuscation device (100) of the present invention may be implemented as a memory (not shown) including a command, a processor (a fake method generation unit (110), an insertion unit (120), a reference relationship generation unit (130)) that generates a fake method by utilizing a generative AI (10) by executing the command, inserts the generated fake method into an application, and generates a reference relationship between the fake method and the classes in the application into which the fake method is inserted.

[0050] Below, each component of the code flow obfuscation device (100) will be described in detail.

[0051] The fake method generation unit (110) is responsible for generating fake methods by utilizing the generative AI (10).

[0052] In the present invention, the fake method generated to be used as an obfuscated code block may be a method configured by randomly selecting and combining two or more code blocks from among a plurality of code blocks randomly generated using artificial intelligence, for example, generative AI (10).

[0053] Below, a more specific example of the process of generating a fake method in the present invention will be described.

[0054] The process of generating a fake method can be described as a first step of generating multiple random code blocks with the same parameters and return values ​​by utilizing a generative AI (10), a second step of generating a fake method composed of two or more code blocks among the multiple code blocks, and a third step of generating multiple fake methods by repeating the second step.

[0055] Specifically, the fake method generation unit (110) utilizes the generative AI (10) to generate multiple random code blocks with the same parameters and return values ​​(step 1).

[0056] In the present invention, the diversity / complexity of code blocks can be increased by utilizing artificial intelligence, for example, generative AI (10).

[0057] In Fig. 1, the code block generation unit (112) is illustrated as the execution subject of the first step.

[0058] For example, the code block generation unit (112) requests the generation type AI (10) to generate a code block by specifying parameters such as the type and number of code blocks to be generated and a return value, and obtains various code blocks generated according to the request from the generation type AI (10), thereby generating a plurality of random code blocks having the same parameters and return values.

[0059] In the present invention, the code block generated in this manner is converted into a method instruction set for subsequent insertion into a class within an application, which is performed immediately after the code block is generated, and the result of the execution can be recorded in a file.

[0060] At this time, in the present invention, each time a random code block is generated using a generative AI (10), the last return node within the code block is deleted, so that the fake method described below can be composed of a combination of two or more code blocks.

[0061] For example, the code block generation unit (112) can delete the last return node within the code block after generating the code block using the generative AI (10) and converting it into a method command set.

[0062] Next, the fake method generation unit (110) generates a fake method composed of two or more code blocks among the multiple code blocks generated in the first step of the tactic (second step).

[0063] In Fig. 1, the method generation unit (114) is illustrated as the execution subject of the second step.

[0064] Specifically, the method generation unit (114) selects a code block having an index corresponding to a random value among multiple code blocks generated in the first step using a random seed, and repeats the operation of sequentially arranging the selected code blocks a preset number of times.

[0065] In this way, the method generation unit (114) can generate a fake method by combining two or more randomly selected code blocks by repeating the tactical operation.

[0066] For example, if the preset number of times is 3, the method generation unit (114) can generate or select a random number, select a code block of an index corresponding to the generated or selected random number from the plurality of code blocks generated in the first step, and place it in the first position for generating a fake method (one operation).

[0067] And the method generation unit (114) can again generate or select a random number value, and select a code block of an index corresponding to the generated or selected random number value from the plurality of code blocks generated in the first step and place it in the second position for generating a fake method (2 operations).

[0068] And the method generation unit (114) can again generate or select a random number value, and select a code block of an index corresponding to the generated or selected random number value from among the multiple code blocks generated in the first step and place it in the second position for generating a fake method (3 operations, the last operation among the preset number of times (3 times)).

[0069] Here, the code block selected by the method generation unit (114) may be an empty block depending on the random value (e.g., when there is no code block with an index corresponding to the random value).

[0070] In this way, the method generation unit (114) can generate a single fake method arranged / combined with two or more randomly selected code blocks by repeating the operation of selecting and sequentially arranging code blocks a preset number of times (e.g., three times).

[0071] Here, the method generation unit (114) can create a single fake method by arranging up to the last code block according to the preset number of times as described above, and can add a predefined return node according to the method instruction at the end of the created fake method.

[0072] And the method generation unit (114) can generate a single fake method in a variety of ways by repeating the process of generating a single fake method (second step) of the above.

[0073] FIG. 3 is an example diagram illustrating a flow for generating a random code block and generating a fake method in the present invention.

[0074] In Fig. 3, an example is shown in which three code blocks are randomly selected and placed per single fake method, assuming a preset number of times of three.

[0075] As can be seen in FIG. 3, according to the present invention, by repeating the operation of selecting and sequentially arranging code blocks a preset number of times (e.g., 3 times), a random fake method is generated by selecting and arranging codeAction2 as the first, an empty block (EmptyBlock) as the second, and codeAction4 as the third among a plurality of code blocks (e.g., codeAction1,2,3,4,...) and arranging them until the last code block, and a return node (Return) of the same type as the method's signature can be added to the end of the generated fake method.

[0076] In this way, in the present invention, by generating a fake method by randomly selecting and combining two or more code blocks, the number of obfuscated code flows generated thereby can be diversified, thereby further increasing the complexity of obfuscation.

[0077] As described above, according to the present invention, a configuration is realized in which a plurality of random code blocks are generated by utilizing a generative AI (10), and then a plurality of obfuscated code blocks (fake methods) are generated by randomly selecting and arranging / combining the plurality of code blocks, thereby generating unpredictable and complex random obfuscated code blocks.

[0078] In particular, according to the present invention, from a plurality of code blocks generated using generative AI (10), it is possible to generate multiple, and even innumerable, unpredictable and complex random obfuscated code blocks (fake methods).

[0079] Of course, it is possible to generate obfuscated code blocks using generative AI (10), but in this case, only one obfuscated code block can be generated at a time, so it is inevitable that a long time will be required to generate a large number of obfuscated code blocks.

[0080] On the other hand, according to the present invention, after a certain amount of code blocks are generated using the generative AI (10), it has the effect of quickly generating a large number of obfuscated code blocks through random selection and arrangement / combination.

[0081] The insertion unit (120) is responsible for the function of inserting the fake method generated in the fake method generation unit (110) into the application (1,..., N) whose code flow is to be obfuscated.

[0082] As an example, referring to application (1), the insertion unit (120) can insert one or more randomly selected fake methods from among several fake methods generated by the fake method generation unit (110) for each class constituting the application (1).

[0083] In this way, in the present invention, for each application (1,..., N) whose code flow is to be obfuscated, one or more fake methods, i.e., obfuscated code blocks, can be inserted into a class constituting the application.

[0084] At this time, the key point is that the obfuscated code block, i.e., the fake method inserted into the application in the present invention is completely unrelated to the application or class to which the method is to be inserted, has no pattern, and is a method generated through random generation, random selection, and arrangement / combination using generative AI (10).

[0085] Below, a more specific example will be described of the process of creating a bidirectional reference, i.e., a reference relationship, when inserting a fake method in the present invention.

[0086] Specifically, the process of creating a reference relationship includes a first process of creating a reference from a fake method to a class into which the fake method is inserted, and a second process of creating a reference from the class to the fake method.

[0087] As illustrated in FIG. 2, the reference relationship generation unit (130) in the code flow obfuscation device (100) of the present invention is responsible for the function of generating a reference relationship.

[0088] To explain an example in detail, when a fake method is inserted into a class by the insertion unit (120), the reference relationship creation unit (130) first performs the first process to forcibly create a reference (method → ​​class) to the fake method.

[0089] Specifically, the reference relationship generation unit (130) searches for constant types in fields and methods within a class into which a fake method has been inserted, creates an array, and defines variables of the searched fields and methods to reference the array created this time (first process).

[0090] Referring to FIGS. 5 and 6, FIG. 5 shows an example of a reference structure of a class within an application before an obfuscated code block generated in the present invention, i.e. a fake method, is inserted.

[0091] Here, originMemberIntA, originMemberIntB, and originMemberIntC are class fields, onCreate refers to the method of the first entry point in the call flow, and initialize refers to the method that is linked (in use) with each field and reference within the class.

[0092] And, assuming an int type field, the function structure within the class corresponding to the reference structure of Fig. 5, i.e., the method and class field, can be explained as an example as in Table 1 below.

[0093]

[0094]

[0095] Meanwhile, FIG. 6 shows an example in which an obfuscated code block generated in the present invention, that is, a fake method Generated_571039976, is inserted, and the corresponding function structure within the class, that is, the method and class field, can be explained as an example as in Table 2 below.

[0096]

[0097]

[0098] As can be seen in Figure 6, the fake method (Generated_571039976) and the reference relationship between the classes are not created, so the fake method (Generated_571039976) is isolated, and thus the fake method (Generated_571039976) can be easily extracted through analysis during reverse engineering.

[0099] Accordingly, in the present invention, when a fake method is inserted into a class, a reference relationship between the fake method and the class is created, and to create the reference relationship, a reference (method → ​​class) is first forcibly created in the fake method.

[0100] Referring to Table 2, an example embodiment is described. The reference relationship generation unit (130) searches for a constant type by iterating over the int type in the fields and methods within the class in which the fake method is inserted, and generates it as one array (“combinedIntArray”).

[0101] And the reference relationship creation unit (130) can forcibly create a reference (method → ​​class) to a fake method by changing the function structure within the class as shown in Table 3 in Table 2 by defining the variables of the fields and methods searched as int type to reference the array created this time.

[0102]

[0103]

[0104] In this way, as shown in Fig. 7, the fake method (Generated_571039976) inserted by the present invention is no longer isolated, but a reference is connected to refer to the field "combinedIntArray" within the class, and the existing code flow within the class can also be maintained as is.

[0105] And, in the present invention, in order to create a reference relationship between a fake method and a class, after the first process of forcibly creating a reference (method → ​​class) to the fake method, a second process is performed to forcibly create a reference (class → method) to the class.

[0106] Specifically, the reference relationship creation unit (130) inserts a call unit (call node) that calls the inserted fake method at the end of the method that is executed first in the class into which the fake method is inserted (second process).

[0107] Referring to Table 3, an example embodiment will be described. The reference relationship generation unit (130) can forcibly generate a reference (class → method) to a class by inserting a call node "Generated_571039976(0, 0);" that calls the fake method (Generated_571039976) inserted this time at the end of onCreate, the method that is executed first in the class, for the class into which the fake method is inserted, thereby changing the function structure within the class as shown in Table 4 in Table 3.

[0108]

[0109]

[0110] In this way, as shown in Fig. 8, the fake method (Generated_571039976) inserted by the present invention references the field "combinedIntArray" within the class and further has a reference relationship in which the reference is linked in both directions so that it is referenced by the class.

[0111] In particular, as can be seen in FIG. 8, according to the present invention, the existing code flow of the application is still maintained, but the overall code flow is seen to increase in complexity and become obfuscated due to the code flow of the fake method (Generated_571039976).

[0112] Meanwhile, in the tactic, the process of creating a reference relationship by assuming an int type field has been described, but this is only one embodiment, and the first and second processes of the tactic can be applied to other types of fields to create the reference relationship of the present invention according to the corresponding type.

[0113] In this way, in the present invention, when inserting a fake method into a class, by performing the first and second steps described above to forcibly create / inject a two-way reference to the fake method, a reference relationship between the fake method and the class can be created that can naturally connect the reference without affecting the code flow of the application.

[0114] According to embodiments of the present invention as described above, in obfuscating the code flow of an application, a configuration is realized in which artificial intelligence (e.g., generative AI) is utilized to generate unpredictable and complex obfuscated code blocks (fake methods), and further, a configuration is realized in which references are naturally connected without affecting the code flow of the application when an obfuscated code block is inserted.

[0115] In particular, since the obfuscated code block generated in the present invention does not have a pattern, it will be impossible to analyze / infer whether it is obfuscated through a pattern, and since the configuration and arrangement within the obfuscated code block are all random / randomized, it may have exponential complexity.

[0116] Accordingly, according to the present invention, it is possible to achieve the effects of significantly improving the limitations of the existing BCG technique in predicting the flow of obfuscated code, and improving the overall obfuscation performance by increasing the resistance to code flow analysis through reference connections that do not affect the code flow of the application.

[0117] Hereinafter, the operation of the code flow obfuscation method according to the present invention will be described with reference to FIG. 4.

[0118] In Fig. 4, the operation according to the code flow obfuscation method of the present invention may correspond to steps S10 to S50.

[0119] In the following description with reference to FIG. 4, for convenience of explanation, the code flow obfuscation device (100) will be mentioned as the operating subject of the present invention.

[0120] According to the present invention, a code flow obfuscation device (100) generates a plurality of random code blocks having the same parameters and return values ​​by utilizing artificial intelligence, for example, generative AI (10) (S10).

[0121] At this time, in the present invention, when generating a random code block using the generative AI (10) in step S10, the last return node within the code block is deleted so that each code block generated has a form that can be combined with each other.

[0122] And according to the present invention, the code flow obfuscation device (100) selects a code block having an index corresponding to a random value among a plurality of code blocks generated in step S10 by utilizing a random seed, and sequentially arranges the selected code blocks by repeating the operation a preset number of times, thereby generating a single fake method by combining two or more randomly selected code blocks (S20).

[0123] At this time, in the present invention, if a single fake method is created by arranging up to the last code block according to the preset number of times in step S20, a predefined return node can be added according to the method command at the end of the created fake method.

[0124] And according to the present invention, the code flow obfuscation device (100) can generate a single fake method in a variety of ways by repeating the step S20 of generating the single fake method described above (S30).

[0125] As described above, according to the present invention, a configuration is realized in which a plurality of random code blocks are generated by utilizing a generative AI (10), and then a plurality of obfuscated code blocks (fake methods) are generated by randomly selecting and arranging / combining the plurality of code blocks, thereby generating unpredictable and complex random obfuscated code blocks.

[0126] In particular, according to the present invention, from a plurality of code blocks generated using generative AI (10), it is possible to generate multiple, and even innumerable, unpredictable and complex random obfuscated code blocks (fake methods).

[0127] In this way, according to the present invention, after a certain amount of code blocks are generated using the generative AI (10), it is possible to quickly generate a large number of obfuscated code blocks through random selection and arrangement / combination.

[0128] Continuing the explanation again, according to the present invention, the code flow obfuscation device (100) generates random fake methods by performing step S30, and then inserts the generated fake methods into the application (1,..., N) whose code flow is to be obfuscated (S40).

[0129] As an example, referring to application (1), the code flow obfuscation device (100) can insert one or more randomly selected fake methods generated in step S30 for each class constituting application (1).

[0130] And, according to the present invention, when inserting a fake method into a class, the code flow obfuscation device (100) forcibly creates a two-way reference to the fake method to create a reference relationship between the fake method and the class (S50).

[0131] Specifically, the code flow obfuscation device (100) can forcibly create / inject a two-way reference to the fake method by performing a process of creating a reference (method → ​​class) from the fake method to the class into which the fake method is inserted when the fake method is inserted into the class, and then performing a process of creating a reference (class → method) from the class to the fake method (S50).

[0132] Accordingly, in the case of an application to which code flow obfuscation according to the present invention is applied, the code flow of the application will be obfuscated in an unpredictable and complex manner due to the code flow of obfuscated code blocks, i.e., random fake methods (S60).

[0133] According to embodiments of the present invention as described above, in obfuscating the code flow of an application, a configuration is realized in which artificial intelligence (e.g., generative AI) is utilized to generate unpredictable and complex obfuscated code blocks (fake methods), and further, a configuration is realized in which references are naturally connected without affecting the code flow of the application when an obfuscated code block is inserted.

[0134] The code flow obfuscation method according to an embodiment of the present invention may be implemented in the form of program commands that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program commands, data files, data structures, etc., alone or in combination. The program commands recorded on the medium may be those specially designed and configured for the present invention or may be those known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program commands such as ROMs, RAMs, and flash memories. Examples of program commands include not only machine language codes generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter, etc. The above hardware device may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

[0135] As described above, the present invention has been described with specific details such as specific components and limited embodiments and drawings, but these are provided only to help understanding of the present invention, and the present invention is not limited to the above embodiments, and those with ordinary knowledge in the field to which the present invention pertains can make various modifications and variations from this description.

[0136] Therefore, the idea of ​​the present invention should not be limited to the described embodiments, and all things that are equivalent or equivalent to the claims described below as well as the claims are considered to fall within the scope of the idea of ​​the present invention.

Claims

1. In a method for obfuscating code flow that operates on a device where an application is executed, A generation step that uses artificial intelligence to create fake methods; An insertion step for inserting the above fake method into the above application; A code flow obfuscation method, characterized in that it includes a reference relationship generation step for generating a reference relationship between a fake method and a class within the application into which the fake method is inserted, so that the code flow of the application is obfuscated due to the code flow of the fake method.

2. In paragraph 1, The above fake method is, A code flow obfuscation method characterized in that it is a method configured by randomly selecting and combining two or more code blocks from among multiple code blocks randomly generated using the above artificial intelligence.

3. In paragraph 1, The above creation step is, A first step of generating multiple random code blocks with the same parameters and return values ​​by utilizing the above artificial intelligence; A second step of generating a fake method consisting of two or more code blocks among the above plurality of code blocks; A code flow obfuscation method characterized by including a third step of generating multiple fake methods by repeating the second step.

4. In paragraph 3, The second step above is, By using a random number, the operation of selecting and sequentially arranging a code block having an index corresponding to the random number among the plurality of code blocks is repeated a preset number of times. A code flow obfuscation method characterized in that the fake method is generated by combining two or more randomly selected code blocks.

5. In paragraph 3, The above first step is, A code flow obfuscation method characterized in that a return node within a code block is deleted each time a random code block is generated, so that the fake method can be composed of a combination of two or more code blocks.

6. In paragraph 3, The second step above is, A code flow obfuscation method characterized by adding a return node at the end of the generated fake method.

7. In paragraph 1, The above reference relationship creation step is: The first step of creating a reference to the class into which the fake method is inserted is performed in the fake method, and the second step of creating a reference to the fake method in the class is performed. A code flow obfuscation method characterized by creating a reference relationship having a two-way reference to the fake method.

8. In paragraph 7, The above first process is, A code flow obfuscation method characterized in that, for a class into which the fake method is inserted, constant types are searched for in fields and methods within the class, and an array is created, and variables of the searched fields and methods are defined to refer to the array.

9. In paragraph 7, The above second process is, A code flow obfuscation method characterized in that, for a class into which the fake method is inserted, a call section that calls the fake method is inserted at the end of the method that is executed first in the class.

10. In the code flow obfuscation device for the application, A fake method generation unit that uses artificial intelligence to generate fake methods; An insertion part that inserts the above fake method into the application; A code flow obfuscation device characterized by including a reference relationship generation unit that generates a reference relationship between a fake method and a class within the application into which the fake method is inserted, so that the code flow of the application is obfuscated due to the code flow of the fake method.

11. A computer program stored on a medium for executing a step of generating a fake method using artificial intelligence, combined with hardware on which an application is executed, a step of inserting the fake method into the application, and a step of creating a reference relationship between the fake method and the class in the application into which the fake method is inserted, so that the code flow of the application is obfuscated by the code flow of the fake method.

Images