{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,8,26]],"date-time":"2024-08-26T15:50:56Z","timestamp":1724687456042},"reference-count":61,"publisher":"Association for Computing Machinery (ACM)","issue":"4","funder":[{"DOI":"10.13039\/501100004963","name":"Seventh Framework Programme","doi-asserted-by":"publisher","award":["609734"],"id":[{"id":"10.13039\/501100004963","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003130","name":"Fonds Wetenschappelijk Onderzoek","doi-asserted-by":"publisher","award":["3G0E2318"],"id":[{"id":"10.13039\/501100003130","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003132","name":"Agentschap voor Innovatie door Wetenschap en Technologie","doi-asserted-by":"publisher","award":["141758"],"id":[{"id":"10.13039\/501100003132","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Priv. Secur."],"published-print":{"date-parts":[[2020,11,30]]},"abstract":"Software protection aims at safeguarding assets embedded in software by preventing and delaying reverse engineering and tampering attacks. This article presents an architecture and supporting tool flow to renew parts of native applications dynamically. Renewed and diversified code and data belonging to either the original application or to linked-in protections are delivered from a secure server to a client on demand. This results in frequent changes to the software components when they are under attack, thus making attacks harder. By supporting various forms of diversification and renewability, novel protection combinations become available and existing combinations become stronger. The prototype implementation is evaluated on several industrial use cases.<\/jats:p>","DOI":"10.1145\/3404891","type":"journal-article","created":{"date-parts":[[2020,8,26]],"date-time":"2020-08-26T04:14:17Z","timestamp":1598415257000},"page":"1-31","update-policy":"http:\/\/dx.doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Code Renewability for Native Software Protection"],"prefix":"10.1145","volume":"23","author":[{"ORCID":"http:\/\/orcid.org\/0000-0001-8999-1709","authenticated-orcid":false,"given":"Bert","family":"Abrath","sequence":"first","affiliation":[{"name":"Ghent University, Belgium"}]},{"given":"Bart","family":"Coppens","sequence":"additional","affiliation":[{"name":"Ghent University, Belgium"}]},{"given":"Jens Van Den","family":"Broeck","sequence":"additional","affiliation":[{"name":"Ghent University, Belgium"}]},{"given":"Brecht","family":"Wyseur","sequence":"additional","affiliation":[{"name":"Kudelski Group, Lausanne, Switzerland"}]},{"given":"Alessandro","family":"Cabutto","sequence":"additional","affiliation":[{"name":"University of East London, United Kingdom"}]},{"given":"Paolo","family":"Falcarin","sequence":"additional","affiliation":[{"name":"University of East London, United Kingdom"}]},{"given":"Bjorn De","family":"Sutter","sequence":"additional","affiliation":[{"name":"Ghent University, Belgium"}]}],"member":"320","published-online":{"date-parts":[[2020,8,25]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Retrieved","year":"2020"},{"key":"e_1_2_1_2_1","volume-title":"Retrieved","year":"2020"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3015135.3015142"},{"key":"e_1_2_1_4_1","volume-title":"Retrieved","author":"ARM.","year":"2005"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.5555\/3220904.3221145"},{"key":"e_1_2_1_6_1","volume-title":"Retrieved","year":"2020"},{"key":"e_1_2_1_7_1","unstructured":"Cataldo Basile (Ed.). 2016. ASPIRE Framework Report. Deliverable D5.11 v1.0. ASPIRE. Cataldo Basile (Ed.). 2016. ASPIRE Framework Report. Deliverable D5.11 v1.0. ASPIRE."},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-40061-5_21"},{"key":"e_1_2_1_9_1","volume-title":"Retrieved","year":"2016"},{"key":"e_1_2_1_10_1","volume-title":"Proceedings of the Google I\/O Developer Conference","volume":"23","author":"Bornstein Dan","year":"2008"},{"key":"e_1_2_1_11_1","volume-title":"Proceedings of the WOOT \u201917 Workshop Program Colocated with the 26th USENIX Security Symposium.","author":"Brasser Ferdinand","year":"2017"},{"key":"e_1_2_1_12_1","volume-title":"Proceedings of the WhibOx 2016 Workshop on White-Box Cryptography and Obfuscation.","author":"Wyseur Brecht","year":"2016"},{"key":"e_1_2_1_14_1","volume-title":"Retrieved","author":"BSA.","year":"2018"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/2808475.2808481"},{"key":"e_1_2_1_16_1","volume-title":"Proceedings of the International Working Conference on Source Code Analysis and Manipulation. 27--36","author":"Ceccato Mariano"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-018-9625-6"},{"key":"e_1_2_1_18_1","volume-title":"Proceedings of the 9th International Workshop on Selected Areas in Cryptography. 250--270","author":"Chow Stanley"},{"key":"e_1_2_1_19_1","volume-title":"Operating system protection through program evolution. Computers 8 Security 12, 6","author":"Cohen Frederick B.","year":"1993"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420997"},{"key":"e_1_2_1_21_1","volume-title":"Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection","author":"Collberg Christian","year":"2009"},{"key":"e_1_2_1_22_1","volume-title":"Bjorn De Sutter, and Koen De Bosschere","author":"Coppens Bart","year":"2013"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2015.23264"},{"key":"e_1_2_1_24_1","volume-title":"Proceedings of the 4th ACM International Workshop on Wireless of the Students, by the Students, for the Students.","author":"Davi Lucas","year":"2012"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/384197.384204"},{"key":"e_1_2_1_26_1","unstructured":"Bjorn De Sutter (Ed.). 2016. ASPIRE Validation Report. Deliverable D1.06. ASPIRE EU FP7 Project. ASPIRE. https:\/\/aspire-fp7.eu. Bjorn De Sutter (Ed.). 2016. ASPIRE Validation Report. Deliverable D1.06. ASPIRE EU FP7 Project. ASPIRE. https:\/\/aspire-fp7.eu."},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/WICSA.2016.43"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/268946.268948"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2011.34"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/WorldCIS17046.2011.5749894"},{"key":"e_1_2_1_31_1","volume-title":"Proceedings of the 1997 6th Workshop on Hot Topics in Operating Systems. 67--72","author":"Forrest S.","year":"1997"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/1900546.1900550"},{"key":"e_1_2_1_33_1","volume-title":"Proceedings of the ACM Symposium on Information, Computer, and Communications Security. 189--200","author":"Juan"},{"key":"e_1_2_1_34_1","volume-title":"Proceedings of the USENIX Security Symposium. 475--490","author":"Giuffrida Cristiano"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2011.39"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-38631-2_22"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/1055626.1055632"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516675"},{"key":"e_1_2_1_39_1","volume-title":"Retrieved","author":"Internet Engineering Task Force (IETF).","year":"2011"},{"key":"e_1_2_1_40_1","volume-title":"Moving Target Defense. Advances in Information Security","author":"Jackson Todd"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPRO.2015.10"},{"key":"e_1_2_1_42_1","volume-title":"Proceedings of the 2004 ACM Workshop on Rapid Malcode. ACM","author":"James"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2006.9"},{"key":"e_1_2_1_44_1","volume-title":"Security through diversity: Are we there yet? IEEE Security 8 Privacy 12, 2","author":"Larsen Per","year":"2014"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.25"},{"key":"e_1_2_1_46_1","volume-title":"Proceedings of the 2017 USENIX Security Symposium. 557--574","author":"Lee Sangho","year":"2017"},{"key":"e_1_2_1_47_1","volume-title":"Retrieved","year":"2020"},{"key":"e_1_2_1_48_1","volume-title":"Retrieved","author":"Technologies Oreans","year":"2020"},{"key":"e_1_2_1_49_1","volume-title":"Retrieved","author":"Technologies Oreans","year":"2020"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2008.21"},{"key":"e_1_2_1_51_1","volume-title":"Pioneer: Verifying code integrity and enforcing untampered code execution on legacy systems. In Malware Detection. Advances in Information Security","author":"Seshadri Arvind","year":"2007"},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420996"},{"key":"e_1_2_1_53_1","volume-title":"Fuzzing: Brute Force Vulnerability Discovery. Pearson Education.","author":"Sutton Michael","year":"2007"},{"key":"e_1_2_1_54_1","volume-title":"Threat Report","author":"Enterprise Symantec","year":"2018"},{"key":"e_1_2_1_55_1","volume-title":"Retrieved","author":"van der Ende M.","year":"2020"},{"key":"e_1_2_1_56_1","volume-title":"Proceedings of the International Symposium on Signal Processing and Information Technology. 7--12","author":"Put Ludo Van","year":"2005"},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/2995306.2995315"},{"key":"e_1_2_1_58_1","volume-title":"Retrieved","author":"Software Protect","year":"2020"},{"key":"e_1_2_1_59_1","volume-title":"Security through diversity: Leveraging virtual machine technology","author":"Williams Daniel","year":"2009"},{"key":"e_1_2_1_61_1","unstructured":"Brecht Wyseur and Bjorn De Sutter (Eds.). 2016. ASPIRE Reference Architecture. Deliverable D1.04 v2.1. ASPIRE. Brecht Wyseur and Bjorn De Sutter (Eds.). 2016. ASPIRE Reference Architecture. Deliverable D1.04 v2.1. ASPIRE."},{"key":"e_1_2_1_62_1","volume-title":"Proceedings of the 2003 22nd International Symposium on Reliable Distributed Systems. IEEE","author":"Xu Jun"},{"key":"e_1_2_1_63_1","volume-title":"Retrieved","author":"Zumerle Dionisio","year":"2017"}],"container-title":["ACM Transactions on Privacy and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3404891","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T11:46:46Z","timestamp":1672573606000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3404891"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,8,25]]},"references-count":61,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2020,11,30]]}},"alternative-id":["10.1145\/3404891"],"URL":"https:\/\/doi.org\/10.1145\/3404891","relation":{},"ISSN":["2471-2566","2471-2574"],"issn-type":[{"value":"2471-2566","type":"print"},{"value":"2471-2574","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,8,25]]},"assertion":[{"value":"2019-03-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-05-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-08-25","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}