Fingerprinting Compiled Binaries for Partial Code Theft Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for combating software theft focus on the entire software and are ineffective in identifying stolen portions of the underlying code, as they rely on watermarks or hash values that can be easily modified, and do not account for the scenario where only unique portions of the code are stolen.
Innovation Solution
Generating fingerprints from compiled computer binaries using disassembled control flow graphs and function call graphs to identify similarities between different software, allowing for the detection of stolen code portions even when the overall operation is different.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If watermarks are applied to software to identify stolen copies, then software theft detection is improved, but the technique can be overcome by removing watermarks from stolen or authorized software
Solution Approach 1:
The patent extracts the detection mechanism from the software itself by using external fingerprinting services. Instead of embedding watermarks within the software that can be removed, the system creates fingerprints of the software's behavioral characteristics and compares these fingerprints externally, making the detection mechanism independent of the software's internal structure and immune to watermark removal attacks.
Solution Approach 2:
The patent introduces an intermediary fingerprinting service that acts as a mediator between the software and the detection system. This intermediary creates a representation (fingerprint) of the software's essential characteristics without modifying the software itself, allowing for theft detection without direct modification of the software or its watermarks.
2Reliability
If hash values are used to compare authorized and stolen software, then theft identification is improved, but hash values do not match when only portions of code are stolen
Solution Approach 1:
The patent segments the software into multiple functional components and creates fingerprints for each segment's behavioral characteristics. This allows the system to detect theft at the segment level rather than requiring a complete hash match of the entire software, enabling precise identification of stolen portions even when only parts of the code are copied.
Solution Approach 2:
The patent transitions from comparing software at the binary/hash level (one-dimensional) to comparing software at the behavioral/fingerprint level (multi-dimensional). By analyzing multiple characteristics such as control flow graphs, function call patterns, and execution behavior across different dimensions, the system can detect partial code theft that traditional hash comparison misses.
3Reliability
If watermarks are applied to identify stolen software, then theft detection is improved, but modification of computer code is required which is undesirable
Solution Approach 1:
The patent inverts the traditional approach by not modifying the software to add detection capabilities, but rather analyzing the software's existing behavioral characteristics to create fingerprints for detection. This inversion eliminates the need for code modification while maintaining effective theft detection capability.
Solution Approach 2:
The patent enables the software to essentially detect its own theft by creating fingerprints of its inherent behavioral characteristics. The software's own execution patterns, control flow, and function calls serve as the detection mechanism, eliminating the need for external modification or complex embedding of watermarks.
4Reliability
If focus is placed on the entire software for theft detection, then detection coverage is improved, but theft of only unique portions cannot be identified
Solution Approach 1:
The patent segments the software into distinct functional components and creates separate fingerprints for each segment's behavioral characteristics. This segmentation allows the system to detect theft at any level - from complete software copies to partial extraction of unique portions - maintaining comprehensive detection coverage while enabling precise identification of stolen code fragments.
Solution Approach 2:
The patent applies local quality analysis by creating fingerprints that capture the unique behavioral characteristics of specific software segments rather than treating the entire software as a homogeneous unit. This allows different parts of the software to be analyzed and compared individually, enabling detection of partial theft of unique portions while maintaining overall detection coverage.
Data Source
AI summary
Systems and methods of detecting copying of computer code or portions of computer code involve generating unique fingerprints from compiled computer binaries. The unique fingerprints are simplified representations of the compiled computer binaries and are compared with each other to identify similarities between the compiled computer binaries. Copying can be detected when there are sufficient similarities between at least portions of two compiled computer binaries.