Protecting sensitive program content is a critical issue in various situations, ranging from legitimate use cases to unethical contexts. Obfuscation is one of the most used techniques to ensure such protection. Consequently, attackers must first detect and characterize obfuscation before launching any attack against it. This paper investigates the problem of function-level obfuscation detection using graph-based approaches, comparing algorithms, from elementary baselines to promising techniques like GNN (Graph Neural Networks), on different feature choices. We consider various obfuscation types and obfuscators, resulting in two complex datasets. Our findings demonstrate that GNNs need meaningful features that capture aspects of function semantics to outperform baselines. Our approach shows satisfactory results, especially in a challenging 11-class classification task and in a practical malware analysis example.

翻译：保护敏感程序内容在各类场景中——从合法用例到非伦理情境——均为关键问题。混淆是实现此类保护最常用的技术之一。因此，攻击者在发起任何攻击前，必须首先检测并表征混淆机制。本文研究基于图方法的函数级混淆检测问题，在不同特征选择下比较了从基础基线算法到图神经网络等前沿技术的性能。我们考虑了多种混淆类型与混淆器，构建了两个复杂数据集。研究结果表明，图神经网络需要能够捕捉函数语义特征的有效特征才能超越基线方法。我们的方法取得了令人满意的结果，尤其在具有挑战性的11类别分类任务及实际恶意软件分析案例中表现突出。