A Dynamic Birthmark from Analyzing Operand Stack Runtime Behavior to Detect Copied Software

Recently, software theft was continually reported. The one of technique for detecting software theft was proposed, named software birthmarks. The software birthmark extracts the set of native and unique characteristics from binary program and compares them to detect suspected copy. The software birthmark is classified by extraction methods into static birthmark and dynamic birthmark. In this paper proposed a dynamic birthmark based on operand stack runtime behaviors of Java Virtual Machine (JVM). The birthmark is originally proposed by Park et al. as a static birthmark. Contributions of this paper are (1) to port a static birthmark to a dynamic birthmark, and (2) to construct basic dynamic analysis technique based on opcode at runtime. To show the effectiveness of the proposed birthmark, we conduct three experiments. The experiments evaluate distinction performance and preservation performance of the birthmark. The preservation performance shows that the proposed birth-mark tolerates against automatic program transformation (About 90% of the birthmark is preserved). The distinction performance shows that the proposed birthmark can distinguish non-copied programs.