Instruction-Words Based Software Birthmark

An instruction-words based software birthmark is proposed by applying the idea of document copy detection technology based on word frequency. The birthmark extraction algorithm consists of two steps. Firstly, an instruction-word library is established by taking statistic on instruction combinations of program samples, and then instruction-words are extracted according to the instruction-word library. The birthmark is composed of instruction-words and their frequencies. In order to ensure that the birthmark has a better performance, this paper analyzes several forms of instruction-word frequency vectors. Then the form transformed with instruction-words of the one program as benchmark is selected to calculate birthmark similarity with vector cosine. To evaluate the performance of the birthmark, nearly ten thousand Java class files are gathered to establish an instruction-word library, which contains about fifty thousand instruction-words. By comparing 28 pieces of Java software, the experimental results indicate that the birthmark has good credibility and general resilience.