{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T15:23:26Z","timestamp":1759332206119,"version":"3.44.0"},"publisher-location":"Cham","reference-count":44,"publisher":"Springer Nature Switzerland","isbn-type":[{"type":"print","value":"9783031976193"},{"type":"electronic","value":"9783031976209"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-031-97620-9_13","type":"book-chapter","created":{"date-parts":[[2025,7,10]],"date-time":"2025-07-10T09:27:38Z","timestamp":1752139658000},"page":"223-243","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Experimental Study of\u00a0Binary Diffing Resilience on\u00a0Obfuscated Programs"],"prefix":"10.1007","author":[{"given":"Roxane","family":"Cohen","sequence":"first","affiliation":[]},{"given":"Robin","family":"David","sequence":"additional","affiliation":[]},{"given":"Riccardo","family":"Mori","sequence":"additional","affiliation":[]},{"given":"Florian","family":"Yger","sequence":"additional","affiliation":[]},{"given":"Fabrice","family":"Rossi","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,7,10]]},"reference":[{"key":"13_CR1","doi-asserted-by":"publisher","unstructured":"Bardin, S., David, R., Marion, J.Y.: Backward-bounded DSE: targeting infeasibility questions on obfuscated codes. In: 2017 IEEE Symposium on Security and Privacy (SP), pp. 633\u2013651 (2017). https:\/\/doi.org\/10.1109\/SP.2017.36","DOI":"10.1109\/SP.2017.36"},{"key":"13_CR2","doi-asserted-by":"crossref","unstructured":"Brunet, P., Creusillet, B., Guinet, A., Martinez, J.M.: Epona and the obfuscation paradox: transparent for users and developers, a pain for reversers. In: Proceedings of the 3rd ACM Workshop on Software Protection. SPRO\u201919, New York, NY, USA, pp. 41\u201352. Association for Computing Machinery (2019)","DOI":"10.1145\/3338503.3357722"},{"key":"13_CR3","doi-asserted-by":"crossref","unstructured":"Capozzi, G., D\u2019Elia, D.C., Di\u00a0Luna, G.A., Querzoni, L.: Adversarial attacks against binary similarity systems. arXiv preprint arXiv:2303.11143 (2023)","DOI":"10.1109\/ACCESS.2024.3488204"},{"key":"13_CR4","unstructured":"Cohen, R., David, R., Mori, R., Yger, F., Rossi, F.: Improving binary diffing through similarity and matching intricacies. In: Conference on Artificial Intelligence for Defense (CAID) (2024)"},{"key":"13_CR5","doi-asserted-by":"crossref","unstructured":"Cohen, R., David, R., Yger, F., Rossi, F.: Identifying obfuscated code through graph-based semantic analysis of binary code. In: The 13th International Conference on Complex Networks and their Applications (2024)","DOI":"10.1007\/978-3-031-82427-2_12"},{"key":"13_CR6","unstructured":"Collberg, C.: The tigress C obfuscator (2016). https:\/\/tigress.wtf\/index.html"},{"key":"13_CR7","doi-asserted-by":"crossref","unstructured":"David, R., Coniglio, L., Ceccato, M.: Qsynth-a program synthesis based approach for binary code deobfuscation. In: BAR 2020 Workshop (2020)","DOI":"10.14722\/bar.2020.23009"},{"key":"13_CR8","doi-asserted-by":"crossref","unstructured":"De\u00a0Ghein, R., Abrath, B., De\u00a0Sutter, B., Coppens, B.: Apkdiff: matching android app versions based on class structure. In: Proceedings of the 2022 ACM Workshop on Research on Offensive and Defensive Techniques in the Context of Man At The End (MATE) Attacks. Checkmate \u201922, New York, NY, USA, pp. 1\u201312. Association for Computing Machinery (2022)","DOI":"10.1145\/3560831.3564257"},{"key":"13_CR9","doi-asserted-by":"crossref","unstructured":"Ding, S.H., Fung, B.C., Charland, P.: Asm2vec: boosting static representation robustness for binary clone search against code obfuscation and compiler optimization. In: 2019 IEEE Symposium on Security and Privacy (SP). IEEE (2019)","DOI":"10.1109\/SP.2019.00003"},{"key":"13_CR10","doi-asserted-by":"crossref","unstructured":"Duan, Y., Li, X., Wang, J., Yin, H.: Deepbindiff: learning program-wide code representations for binary diffing. In: Network and Distributed System Security Symposium (2020)","DOI":"10.14722\/ndss.2020.24311"},{"issue":"1","key":"13_CR11","first-page":"3","volume":"5","author":"T Dullien","year":"2005","unstructured":"Dullien, T., Rolles, R.: Graph-based comparison of executable objects (English version). SSTIC 5(1), 3 (2005)","journal-title":"SSTIC"},{"key":"13_CR12","unstructured":"Flake, H.: Structural comparison of executable objects. DIMVA 2004, July 6-7, Dortmund, Germany (2004)"},{"key":"13_CR13","doi-asserted-by":"crossref","unstructured":"Gao, H., Zhang, T., Chen, S., Wang, L., Yu, F.: Fusion: measuring binary function similarity with code-specific embedding and order-sensitive GNN. Symmetry (2022)","DOI":"10.3390\/sym14122549"},{"key":"13_CR14","doi-asserted-by":"publisher","unstructured":"Greco, C., Ianni, M., Guzzo, A., Fortino, G.: Explaining binary obfuscation, pp. 22\u201327 (2023). https:\/\/doi.org\/10.1109\/CSR57506.2023.10224825","DOI":"10.1109\/CSR57506.2023.10224825"},{"key":"13_CR15","unstructured":"Hikari: Hikari-llvm15 (2019). https:\/\/github.com\/61bcdefg\/Hikari-LLVM15"},{"key":"13_CR16","doi-asserted-by":"crossref","unstructured":"Hosseinzadeh, S., et al.: Diversification and obfuscation techniques for software security: a systematic literature review. Inf. Software Technol. (2018)","DOI":"10.1016\/j.infsof.2018.07.007"},{"key":"13_CR17","doi-asserted-by":"crossref","unstructured":"Hu, Y., Zhang, Y., Li, J., Wang, H., Li, B., Gu, D.: Binmatch: a semantics-based hybrid approach on binary code clone analysis. In: 2018 IEEE International Conference on Software Maintenance and Evolution (ICSME). IEEE (2018)","DOI":"10.1109\/ICSME.2018.00019"},{"key":"13_CR18","doi-asserted-by":"crossref","unstructured":"Junod, P., Rinaldini, J., Wehrli, J., Michielin, J.: Obfuscator-LLVM\u2013software protection for the masses. In: Wyseur, B. (ed.) Proceedings of the IEEE\/ACM 1st International Workshop on Software Protection, SPRO\u201915, Firenze, Italy, May 19th, 2015 (2015)","DOI":"10.1109\/SPRO.2015.10"},{"key":"13_CR19","unstructured":"Kim, D., Kim, E., Cha, S.K., Son, S., Kim, Y.: Revisiting binary code similarity analysis using interpretable feature engineering and lessons learned. IEEE Trans. Software Eng. 1\u201323 (2022)"},{"key":"13_CR20","unstructured":"Koret, J.: Diaphora (2015). https:\/\/github.com\/joxeankoret\/diaphora"},{"key":"13_CR21","doi-asserted-by":"crossref","unstructured":"Kostakis, O., Kinable, J., Mahmoudi, H., Mustonen, K.: Improved call graph comparison using simulated annealing. In: Proceedings of the 2011 ACM Symposium on Applied Computing, pp. 1516\u20131523 (2011)","DOI":"10.1145\/1982185.1982509"},{"issue":"1\u20132","key":"13_CR22","doi-asserted-by":"publisher","first-page":"83","DOI":"10.1002\/nav.3800020109","volume":"2","author":"HW Kuhn","year":"1955","unstructured":"Kuhn, H.W.: The hungarian method for the assignment problem. Naval Res. Logist. Quart. 2(1\u20132), 83\u201397 (1955)","journal-title":"Naval Res. Logist. Quart."},{"key":"13_CR23","unstructured":"Li, Y., Gu, C., Dullien, T., Vinyals, O., Kohli, P.: Graph matching networks for learning the similarity of graph structured objects. In: International Conference on Machine Learning, pp. 3835\u20133845. PMLR (2019)"},{"key":"13_CR24","doi-asserted-by":"crossref","unstructured":"Luo, L., Ming, J., Wu, D., Liu, P., Zhu, S.: Semantics-based obfuscation-resilient binary code similarity comparison with applications to software plagiarism detection. In: Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering, pp. 389\u2013400 (2014)","DOI":"10.1145\/2635868.2635900"},{"key":"13_CR25","unstructured":"Marcelli, A., Graziano, M., Ugarte-Pedrero, X., Fratantonio, Y., Mansouri, M., Balzarotti, D.: How machine learning is solving the binary function similarity problem. In: 31st USENIX Security Symposium (USENIX Security 22) (2022)"},{"key":"13_CR26","doi-asserted-by":"crossref","unstructured":"Massarelli, L., Di\u00a0Luna, G.A., Petroni, F., Querzoni, L., Baldoni, R., et\u00a0al.: Investigating graph embedding neural networks with unsupervised features extraction for binary analysis. In: 2nd Workshop on Binary Analysis Research (BAR) (2019)","DOI":"10.14722\/bar.2019.23020"},{"key":"13_CR27","doi-asserted-by":"crossref","unstructured":"Massarelli, L., Di\u00a0Luna, G.A., Petroni, F., Querzoni, L., Baldoni, R.: Safe: self-attentive function embeddings for binary similarity. In: Proceedings of 16th Conference on Detection of Intrusions and Malware and Vulnerability Assessment (DIMVA) (2019)","DOI":"10.1007\/978-3-030-22038-9_15"},{"key":"13_CR28","doi-asserted-by":"crossref","unstructured":"Meng, X., Miller, B.P.: Binary code is not easy. In: Proceedings of the 25th International Symposium on Software Testing and Analysis, pp. 24\u201335 (2016)","DOI":"10.1145\/2931037.2931047"},{"key":"13_CR29","doi-asserted-by":"crossref","unstructured":"Mengin, E., Rossi, F.: Binary diffing as a network alignment problem via belief propagation. In: 2021 36th IEEE\/ACM International Conference on Automated Software Engineering (ASE), pp. 967\u2013978. IEEE (2021)","DOI":"10.1109\/ASE51524.2021.9678782"},{"key":"13_CR30","doi-asserted-by":"publisher","first-page":"961","DOI":"10.1016\/j.procs.2021.08.099","volume":"192","author":"E Mengin","year":"2021","unstructured":"Mengin, E., Rossi, F.: Improved algorithm for the network alignment problem with application to binary diffing. Procedia Comput. Sci. 192, 961\u2013970 (2021)","journal-title":"Procedia Comput. Sci."},{"key":"13_CR31","unstructured":"Mikolov, T., Chen, K., Corrado, G., Dean, J.: Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781 (2013)"},{"key":"13_CR32","unstructured":"Ming, J., Xu, D., Jiang, Y., Wu, D.: BinSim: Trace-based semantic binary diffing via system call sliced segment equivalence checking. In: 26th USENIX Security Symposium (USENIX Security 17), pp. 253\u2013270 (2017)"},{"key":"13_CR33","doi-asserted-by":"crossref","unstructured":"Ming, J., Xu, D., Wu, D.: Memoized semantics-based binary diffing with application to malware lineage inference. In: Federrath, H., Gollmann, D. (eds.) ICT Systems Security and Privacy Protection. Springer, Cham (2015)","DOI":"10.1007\/978-3-319-18467-8_28"},{"key":"13_CR34","unstructured":"Nagra, J., Collberg, C.: Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection: Obfuscation, Watermarking, and Tamperproofing for Software Protection. Pearson Education (2009)"},{"key":"13_CR35","unstructured":"Pei, K., Xuan, Z., Yang, J., Jana, S., Ray, B.: Trex: learning execution semantics from micro-traces for binary similarity. arXiv preprint arXiv:2012.08680 (2020)"},{"key":"13_CR36","doi-asserted-by":"crossref","unstructured":"Shirani, P., Wang, L., Debbabi, M.: Binshape: scalable and robust binary library function identification using function shape. In: International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, pp. 301\u2013324. Springer (2017)","DOI":"10.1007\/978-3-319-60876-1_14"},{"key":"13_CR37","unstructured":"Thomas, R.: O-mvll (2022). https:\/\/github.com\/open-obfuscator\/o-mvll"},{"key":"13_CR38","doi-asserted-by":"crossref","unstructured":"Tofighi-Shirazi, R., Asavoae, I.M., Elbaz-Vincent, P., Le, T.H.: Defeating opaque predicates statically through machine learning and binary analysis. In: Proceedings of the 3rd ACM Workshop on Software Protection, pp. 3\u201314 (2019)","DOI":"10.1145\/3338503.3357719"},{"issue":"9","key":"13_CR39","doi-asserted-by":"publisher","first-page":"3442","DOI":"10.1109\/TSE.2021.3093926","volume":"48","author":"S Ullah","year":"2021","unstructured":"Ullah, S., Oh, H.: Bindiff NN: learning distributed representation of assembly for robust binary diffing against semantic differences. IEEE Trans. Software Eng. 48(9), 3442\u20133466 (2021)","journal-title":"IEEE Trans. Software Eng."},{"key":"13_CR40","unstructured":"Wang, C.: A Security Architecture for Survivability Mechanisms. University of Virginia (2001)"},{"key":"13_CR41","doi-asserted-by":"crossref","unstructured":"Wang, H., et al.: Jtrans: jump-aware transformer for binary code similarity detection. In: Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 1\u201313. ISSTA 2022, New York, NY, USA (2022)","DOI":"10.1145\/3533767.3534367"},{"key":"13_CR42","doi-asserted-by":"crossref","unstructured":"Zhang, P., et al.: Khaos: the impact of inter-procedural code obfuscation on binary diffing techniques. In: Proceedings of the 21st ACM\/IEEE International Symposium on Code Generation and Optimization. CGO \u201923, New York, NY, USA, pp. 55\u201367. Association for Computing Machinery (2023)","DOI":"10.1145\/3579990.3580007"},{"key":"13_CR43","doi-asserted-by":"crossref","unstructured":"Zhao, L., Zhu, Y., Ming, J., Zhang, Y., Zhang, H., Yin, H.: Patchscope: memory object centric patch diffing. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 149\u2013165 (2020)","DOI":"10.1145\/3372297.3423342"},{"key":"13_CR44","doi-asserted-by":"crossref","unstructured":"Zhou, Y., Main, A., Gu, Y.X., Johnson, H.: Information hiding in software with mixed boolean-arithmetic transforms. In: International Workshop on Information Security Applications, pp. 61\u201375. Springer (2007)","DOI":"10.1007\/978-3-540-77535-5_5"}],"container-title":["Lecture Notes in Computer Science","Detection of Intrusions and Malware, and Vulnerability Assessment"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-97620-9_13","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,7]],"date-time":"2025-09-07T01:52:22Z","timestamp":1757209942000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-97620-9_13"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783031976193","9783031976209"],"references-count":44,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-97620-9_13","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"10 July 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"DIMVA","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Graz","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Austria","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"9 July 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"11 July 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"dimva2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/dimva.org\/dimva2025\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}