Behavior based software theft detection

Xinran Wang, Yoon Chan Jhi, Sencun Zhu, Peng Liu

Research output: Chapter in Book/Report/Conference proceedingConference contribution

80 Scopus citations


Along with the burst of open source projects, software theft (or plagiarism) has become a very serious threat to the healthiness of software industry. Software birthmark, which represents the unique characteristics of a program, can be used for software theft detection. We propose a system call dependence graph based software birthmark called SCDG birthmark, and examine how well it reflects unique behavioral characteristics of a program. To our knowledge, our detection system based on SCDG birthmark is the first one that is capable of detecting software component theft where only partial code is stolen. We demonstrate the strength of our birthmark against various evasion techniques, including those based on different compilers and different compiler optimization levels as well as two state-of-the-art obfuscation tools. Unlike the existing work that were evaluated through small or toy software, we also evaluate our birthmark on a set of large software. Our results show that SCDG birthmark is very practical and effective in detecting software theft that even adopts advanced evasion techniques.

Original languageEnglish (US)
Title of host publicationCCS'09 - Proceedings of the 16th ACM Conference on Computer and Communications Security
Number of pages11
StatePublished - 2009
Event16th ACM Conference on Computer and Communications Security, CCS'09 - Chicago, IL, United States
Duration: Nov 9 2009Nov 13 2009

Publication series

NameProceedings of the ACM Conference on Computer and Communications Security
ISSN (Print)1543-7221


Other16th ACM Conference on Computer and Communications Security, CCS'09
Country/TerritoryUnited States
CityChicago, IL

All Science Journal Classification (ASJC) codes

  • Software
  • Computer Networks and Communications


Dive into the research topics of 'Behavior based software theft detection'. Together they form a unique fingerprint.

Cite this