Jinwoon Woo

Computing biconnected components on a hypercube

We describe two hypercube algorithms to find the biconnected components of a dense connected undirected graph. One is a modified version of the Tarjan-Vishkin algorithm and the other is an adaptation of Reads sequential algorithm. The two hypercube algorithms were experimentally evaluated on an NCUBE/7 MIMD hypercube computer. The two algorithms have comparable performance, and efficiencies as high as 0.7 were observed on dense graphs.

A Static Birthmark for MS Windows Applications Using Import Address Table

A software birthmark is unique and native characteristics of software, and thus can be used to detect the theft of software. We propose a new static software birthmark for programs on Microsoft Windows which have Portable Executable (PE) format. These programs use different Dynamic Link Libraries (DLLs) and Application Program Interfaces (APIs) while they are executing. The number and names of the used DLLs and APIs are unique to each program. The proposed birthmark is based on these numbers and names. This information can be obtained from the Import Address Table (IAT), which is part of the PE file. By inspecting the proposed birthmark, we can identify certain software and detect pirated software. To evaluate the effectiveness of the proposed birthmark, we inspect and compare several applications of different kinds. The experimental results show that the proposed birthmark can identify Windows applications, leading to the prevention of an illegal distribution of copyrighted software.

Measuring similarity of windows applications using static and dynamic birthmarks

A software birthmark is unique, as certain native characteristics of a program, hence can be used to measure the similarity between programs. In general, a static software birthmark does not need program execution, but is more vulnerable to attacks by semantic-preserving transformations. A dynamic software birthmark is applicable to packed executables, but cannot cover all the possible program paths. In this paper, we propose a novel effective technique to measure the similarity of Microsoft Windows applications using both static and dynamic birthmarks, which are based on the list of system APIs as well as the frequency of system API calls. Because system APIs are located in Windows system directories and act as a bridge between applications and the operating system, our birthmarks are resilient to obfuscations and compiler optimizations. A static birthmark consists of the system API call frequency of a target program, which can be extracted by scanning the executable file. A dynamic birthmark is the frequency of system API function calls, which can be extracted by a binary instrumentation tool during the execution of the program. To evaluate the effectiveness of the proposed technique, we compare various types of Windows applications using both the static and dynamic birthmarks. To demonstrate the robustness, we compare packed executables that were compressed by a binary packing tool. We carry out additional experiments for measuring the similarity between target Windows applications at the source code level and verify the evaluation results. The experimental results show that our birthmarks can effectively measure the similarity between Windows applications, as intended.

Hypercube computing; Connected components

The connected-components problem is used to illustrate the programming issues that arise when a multiple-instruction/multiple-data hypercube multicomputer is used. These issues include selection of algorithmic abstraction, problem partitioning and mapping, overlapping computation and communication, and load balancing. Performance measures are also discussed.<<ETX>>

Identifying Windows Installer Package Files for Detection of Pirated Software

Nowadays, pirated software is being illegally distributed in various ways such as websites, peer-to-peer (P2P) networks, blogs, and so on. In order to prevent such illegal distribution of software, it is necessary to identify application programs and filter illegally distributed software online. Unfortunately, the existing methods fail to find pirated software, which is delivered in an installer package file format, because they mainly handle executable file formats. Motivated by this, we propose an efficient identification method for detecting pirated software circulated in the Windows installer package format (.msi file), a representative installer package file format of Windows. Our experiment shows that the proposed method identifies well the programs in the Windows installer package format, thereby defending against unlawful software distribution.