NDLI: A family of experiments to assess the effectiveness and efficiency of source code obfuscation techniques

Content Provider	Springer Nature Link
Author	Ceccato, Maria Penta, Massimilia Falcarin, Paolo Ricca, Filippo Torchia, Marco Tonella, Paolo
Copyright Year	2013
Abstract	Context: code obfuscation is intended to obstruct code understanding and, eventually, to delay malicious code changes and ultimately render it uneconomical. Although code understanding cannot be completely impeded, code obfuscation makes it more laborious and troublesome, so as to discourage or retard code tampering. Despite the extensive adoption of obfuscation, its assessment has been addressed indirectly either by using internal metrics or taking the point of view of code analysis, e.g., considering the associated computational complexity. To the best of our knowledge, there is no publicly available user study that measures the cost of understanding obfuscated code from the point of view of a human attacker. Aim: this paper experimentally assesses the impact of code obfuscation on the capability of human subjects to understand and change source code. In particular, it considers code protected with two well-known code obfuscation techniques, i.e., identifier renaming and opaque predicates. Method: We have conducted a family of five controlled experiments, involving undergraduate and graduate students from four Universities. During the experiments, subjects had to perform comprehension or attack tasks on decompiled clients of two Java network-based applications, either obfuscated using one of the two techniques, or not. To assess and compare the obfuscation techniques, we measured the correctness and the efficiency of the performed task. Results: —at least for the tasks we considered—simpler techniques (i.e., identifier renaming) prove to be more effective than more complex ones (i.e., opaque predicates) in impeding subjects to complete attack tasks.
Starting Page	1040
Ending Page	1074
Page Count	35
File Format	PDF
ISSN	13823256
Journal	Empirical Software Engineering
Volume Number	19
Issue Number	4
e-ISSN	15737616
Language	English
Publisher	Springer US
Publisher Date	2013-02-23
Publisher Place	Boston
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Empirical studies Software obfuscation Program comprehension Software Engineering/Programming and Operating Systems Programming Languages, Compilers, Interpreters
Content Type	Text
Resource Type	Article
Subject	Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

An empirical study of identifier splitting techniques

Labeling source code with information retrieval methods: an empirical study

Program comprehension of domain-specific and general-purpose languages: comparison using a family of experiments

Guest editorial: Program comprehension

Special issue on program comprehension

Confounding parameters on program comprehension: a literature survey

An empirical analysis of information retrieval based concept location techniques in software comprehension

Do background colors improve program comprehension in the #ifdef hell?

Empirical Studies of Evolving Systems

A family of experiments to assess the effectiveness and efficiency of source code obfuscation techniques

Similar Documents

An empirical study of identifier splitting techniques

Labeling source code with information retrieval methods: an empirical study

Program comprehension of domain-specific and general-purpose languages: comparison using a family of experiments

Guest editorial: Program comprehension

Special issue on program comprehension

Confounding parameters on program comprehension: a literature survey

An empirical analysis of information retrieval based concept location techniques in software comprehension

Do background colors improve program comprehension in the #ifdef hell?

Empirical Studies of Evolving Systems

A family of experiments to assess the effectiveness and efficiency of source code obfuscation techniques