A Systematic Study on Static Control Flow Obfuscation Techniques in Java
Renuka Kumar, Anjana Mariam Kurian

TL;DR
This paper systematically analyzes static control flow obfuscation techniques in Java, revealing gaps between research and commercial tools, and proposes a new classification to improve understanding and development of effective obfuscation methods.
Contribution
It provides the first comprehensive classification of CFO techniques, compares literature and tools, and identifies gaps in implementation against potent obfuscation methods.
Findings
36 unique techniques in literature, 7 in tools
Most tools implement only 13 of the 36 techniques
Majority of tools lack potent obfuscation techniques
Abstract
Control flow obfuscation (CFO) alters the control flow path of a program without altering its semantics. Existing literature has proposed several techniques; however, a quick survey reveals a lack of clarity in the types of techniques proposed, and how many are unique. What is also unclear is whether there is a disparity in the theory and practice of CFO. In this paper, we systematically study CFO techniques proposed for Java programs, both from papers and commercially available tools. We evaluate 13 obfuscators using a dataset of 16 programs with varying software characteristics, and different obfuscator parameters. Each program is carefully reverse engineered to study the effect of obfuscation. Our study reveals that there are 36 unique techniques proposed in the literature and 7 from tools. Three of the most popular commercial obfuscators implement only 13 of the 36 techniques in the…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Security and Verification in Computing · Adversarial Robustness in Machine Learning
