DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network

Round 1

Reviewer 1 Report

In this paper the authors propose a ML-based method to analyze obfuscated code.

I have some doubts about the novelty of the paper since in the literature other works exist addressing the same topic. However, if the results of the paper overcome the state-of-the-art results, it can be considered a contribution for the literature.

About this latter point, it represents the major issue of the paper. The authors fail to compare with (or least to cite) relevant works such as [1] and [2].

In the experiment section, the authors say that their approach overcomes Asm2Vec and Xyntia for O-LVVM and Triggers. This is not enough. They should better discuss and quantify the enanchements they claim. Moreover, what about the comparison with other solutions?

Minor issues:

-The first part of the introduction, from "Existing obfuscation " until ".. in total" is too technical and should be moved into another section.

-The related work section is too short and includes few citations.

-Several typos are present. Here, some examples:

mainly studied the virtualization-based commercial obfuscators VMProtect and Themida, There are

At present, Some researchers analyze the semantic information of the code from the IR perspective

in the graph [25?

at about %98.6

OLLWM at line 61

[1] S. Wang, P. Wang and D. Wu, "Semantics-Aware Machine Learning for Function Recognition in Binary Code," 2017 IEEE International Conference on Software Maintenance and Evolution (ICSME), 2017, pp. 388-398, doi: 10.1109/ICSME.2017.59.

 

 

[2]Ramtine Tofighi-Shirazi, Irina-Mariuca Asavoae, Philippe Elbaz-Vincent, and Thanh-Ha Le. 2019. Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis. In Proceedings of the 3rd ACM Workshop on Software Protection (SPRO'19). Association for Computing Machinery, New York, NY, USA, 3–14. https://doi.org/10.1145/3338503.3357719

 

 

 

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 2 Report

The article is interesting but poorly written. The language, and English of the paper must be improved.

Page 1, line 2, "they also help produce", consider changing to "they also help to produce" or "they also help producing ".

Section 2 related works: the authors mentioned often that "some researchers", I suggest to write "few studies", also provide some references to support this.

Section 3, Our Approach should be Proposed Approach. Also, Our insights should be "Overview or background" or better remove subsection headings 3.1 and 3.2 and write without subheadings

Discussion section is very small, better merge with Results section

Results are not clear, author should provide more details explaining the results.

 

 

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Round 2

Reviewer 1 Report

The authors addressed all the comments and the quality of the paper, in the current form, appears acceptable for publication. 

Reviewer 2 Report

The authors have revised the article as suggested. Maybe accepted