Control Flow Obfuscation using Neural Network to Fight Concolic Testing

• Main Authors: Ma, Haoyu, Ma, Xinjie, Liu, Weijie, Huang, Zhipeng, GAO, Debin, Jia, Chunfu
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2014
• Subjects: Software obfuscation; malware analysis; reverse engineering; concolic testing; neural network; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/2260; https://ink.library.smu.edu.sg/context/sis_research/article/3260/viewcontent/GaoDControlFlowObfuscationsecurecomm14.pdf
• Institution: Singapore Management University

Concolic testing is widely regarded as the state-of-the-art technique in dynamic discovering and analyzing trigger-based behavior in software programs. It uses symbolic execution and an automatic theorem prover to generate new concrete test cases to maximize code coverage for scenarios like software verification and malware analysis. While malicious developers usually try their best to hide malicious executions, there are also circumstances in which legitimate reasons are presented for a program to conceal trigger-based conditions and the corresponding behavior, which leads to the demand of control flow obfuscation techniques. We propose a novel control flow obfuscation design based on the incomprehensibility of artificial neural networks to fight against reverse engineering tools including concolic testing. By training neural networks to simulate conditional behaviors of a program, we manage to precisely replace essential points of a program’s control flow with neural network computations. Evaluations show that since the complexity of extracting rules from trained neural networks easily goes beyond the capability of program analysis tools, it is infeasible to apply concolic testing on code obfuscated with our method. Our method also incorporates only basic integer operations and simple loops, thus can be hard to be distinguished from regular programs.