DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network
Round 1
Reviewer 1 Report
In this paper the authors propose a ML-based method to analyze obfuscated code.
I have some doubts about the novelty of the paper since in the literature other works exist addressing the same topic. However, if the results of the paper overcome the state-of-the-art results, it can be considered a contribution for the literature.
About this latter point, it represents the major issue of the paper. The authors fail to compare with (or least to cite) relevant works such as [1] and [2].
In the experiment section, the authors say that their approach overcomes Asm2Vec and Xyntia for O-LVVM and Triggers. This is not enough. They should better discuss and quantify the enanchements they claim. Moreover, what about the comparison with other solutions?
Minor issues:
-The first part of the introduction, from "Existing obfuscation " until ".. in total" is too technical and should be moved into another section.
-The related work section is too short and includes few citations.
-Several typos are present. Here, some examples:
mainly studied the virtualization-based commercial obfuscators VMProtect and Themida, There are
At present, Some researchers analyze the semantic information of the code from the IR perspective
in the graph [25?
at about %98.6
OLLWM at line 61
[1] S. Wang, P. Wang and D. Wu, "Semantics-Aware Machine Learning for Function Recognition in Binary Code," 2017 IEEE International Conference on Software Maintenance and Evolution (ICSME), 2017, pp. 388-398, doi: 10.1109/ICSME.2017.59.
[2]Ramtine Tofighi-Shirazi, Irina-Mariuca Asavoae, Philippe Elbaz-Vincent, and Thanh-Ha Le. 2019. Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis. In Proceedings of the 3rd ACM Workshop on Software Protection (SPRO'19). Association for Computing Machinery, New York, NY, USA, 3–14. https://doi.org/10.1145/3338503.3357719
Author Response
Please see the attachment.
Author Response File: Author Response.pdf
Reviewer 2 Report
The article is interesting but poorly written. The language, and English of the paper must be improved.
Page 1, line 2, "they also help produce", consider changing to "they also help to produce" or "they also help producing ".
Section 2 related works: the authors mentioned often that "some researchers", I suggest to write "few studies", also provide some references to support this.
Section 3, Our Approach should be Proposed Approach. Also, Our insights should be "Overview or background" or better remove subsection headings 3.1 and 3.2 and write without subheadings
Discussion section is very small, better merge with Results section
Results are not clear, author should provide more details explaining the results.
Author Response
Please see the attachment.
Author Response File: Author Response.pdf
Round 2
Reviewer 1 Report
The authors addressed all the comments and the quality of the paper, in the current form, appears acceptable for publication.
Reviewer 2 Report
The authors have revised the article as suggested. Maybe accepted