Search

API calls are programming interfaces used by applications. When it is difficult for an analyst to perform a direct reverse analysis of a program, the API provides an important basis for analyzing the behavior and functionality of the program. API address spaces are essential for analysts to identify API call information, and therefore API call obfuscation is used as a protection strategy to prevent analysts from obtaining call information from API address spaces. API call obfuscation avoids direct API calls and aims to create a more complex API calling process. Unfortunately, current API call obfuscation methods are not effective in preventing analysts from obtaining usable information from the API address space. To solve this issue, in this paper, we propose an API call obfuscation model based on address space obscurity. The key functions within the API are encrypted and moved to the user code space for execution. This breaks the relationship between the API and its address space, making it impossible for analysts to obtain address information about a known API from the API address space. In our experiments, we developed an archetypical compiler-level API call obfuscation system to automate the obfuscation of input source code into an obfuscated file. The results show that our approach can thwart existing API deobfuscation techniques and is highly resistant to various open-source dynamic analysis platforms. Compared to other obfuscation techniques, our scheme improves API address space obscurity by more than two times, the detection rate of deobfuscation techniques such as Scylla, etc. is zero, and the increase in obfuscation overhead is not more than 20%. The above results show that APIASO has better obfuscation effect and practicability.

Represented by reactive security defense mechanisms, cyber defense possesses a static, reactive, and deterministic nature, with overwhelmingly high costs to defend against ever-changing attackers. To change this situation, researchers have proposed moving target defense (MTD), which introduces the concept of an attack surface to define cyber defense in a brand-new manner, aiming to provide a dynamic, continuous, and proactive defense mechanism. With the increasing use of machine learning in networking, researchers have discovered that MTD techniques based on machine learning can provide omni-bearing defense capabilities and reduce defense costs at multiple levels. However, research in this area remains incomplete and fragmented, and significant progress is yet to be made in constructing a defense mechanism that is both robust and available. Therefore, we conducted a comprehensive survey on MTD research, summarizing the background, design mechanisms, and shortcomings of MTD, as well as relevant features of intelligent MTD that are designed to overcome these limitations. We aim to provide researchers seeking the future development of MTD with insight into building an intelligently affordable, optimized, and self-adaptive defense mechanism.

Karst tunnels commonly pass through large karst caves during their construction and operation. Although treatment technologies are relatively mature, a systematic treatment method to guide the selection of treatment technologies is lacking. To solve this problem, a spatial decomposition method (SDM) of large karst caves is proposed that is based on analyzing the spatial relationship between tunnels and karst caves and summarizing the relevant treatment techniques. In this method, the space between the tunnel and the cavern is divided into eight parts using a space dividing line (SDL), which makes the spatial position relationship between the tunnel and cavern more intuitive. A geometric model of the SDM is established, and the numerical values of each geometric parameter are determined by field surveys and drawings. Constructing a three-dimensional spatial diagram by applying relevant parameters to the geometric model provides a reference for selecting a treatment technology. The SDM of the arch top, arch bottom, and two wings matching the treatment technology is proposed. Seven principles of technical selection—namely, safety, convenience, scientificity, sustainability, economy, feasibility, and openness—are mentioned in order to overcome the difficulty of technology selection due to such factors as technological diversity, materials, equipment, and environment. Finally, the SDM is used to solve the problem of the Shangyuan tunnel passing through a large karst cave. The implementation of the SDM in tunnel construction would represent a significant breakthrough and has important engineering value in solving the problem of tunnel passes through large karst caves.