{"id":"https://openalex.org/W7126153306","doi":"https://doi.org/10.1109/tse.2026.3659437","title":"Deobfuscation of Control Flow Flattening Based on Abstract Interpretation","display_name":"Deobfuscation of Control Flow Flattening Based on Abstract Interpretation","publication_year":2026,"publication_date":"2026-01-30","ids":{"openalex":"https://openalex.org/W7126153306","doi":"https://doi.org/10.1109/tse.2026.3659437"},"language":null,"primary_location":{"id":"doi:10.1109/tse.2026.3659437","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2026.3659437","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114186489","display_name":"Soyeon Baek","orcid":null},"institutions":[{"id":"https://openalex.org/I196345858","display_name":"Chungnam National University","ror":"https://ror.org/0227as991","country_code":"KR","type":"education","lineage":["https://openalex.org/I196345858"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Soyeon Baek","raw_affiliation_strings":["Department of Computer Science and Engineering, Chungnam National University, Daejeon, Korea"],"raw_orcid":"https://orcid.org/0009-0008-7645-9607","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Chungnam National University, Daejeon, Korea","institution_ids":["https://openalex.org/I196345858"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5124390767","display_name":"Sungho Lee","orcid":null},"institutions":[{"id":"https://openalex.org/I196345858","display_name":"Chungnam National University","ror":"https://ror.org/0227as991","country_code":"KR","type":"education","lineage":["https://openalex.org/I196345858"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Sungho Lee","raw_affiliation_strings":["Department of Computer Science and Engineering, Chungnam National University, Daejeon, Korea"],"raw_orcid":"https://orcid.org/0000-0002-7107-5590","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Chungnam National University, Daejeon, Korea","institution_ids":["https://openalex.org/I196345858"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I196345858"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.10935441,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"52","issue":"3","first_page":"1110","last_page":"1124"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.8769000172615051,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.8769000172615051,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.04520000144839287,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.02710000053048134,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.8942000269889832},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.8118000030517578},{"id":"https://openalex.org/keywords/abstract-interpretation","display_name":"Abstract interpretation","score":0.7870000004768372},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.6855999827384949},{"id":"https://openalex.org/keywords/control-flow","display_name":"Control flow","score":0.6823999881744385},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.6057000160217285},{"id":"https://openalex.org/keywords/symbolic-execution","display_name":"Symbolic execution","score":0.5781000256538391},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.4722999930381775},{"id":"https://openalex.org/keywords/program-analysis","display_name":"Program analysis","score":0.446399986743927}],"concepts":[{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.8942000269889832},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8622000217437744},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.8118000030517578},{"id":"https://openalex.org/C2780654840","wikidata":"https://www.wikidata.org/wiki/Q333341","display_name":"Abstract interpretation","level":2,"score":0.7870000004768372},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.6855999827384949},{"id":"https://openalex.org/C160191386","wikidata":"https://www.wikidata.org/wiki/Q868299","display_name":"Control flow","level":2,"score":0.6823999881744385},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6057000160217285},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.5781000256538391},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.47929999232292175},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.4722999930381775},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.446399986743927},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.41519999504089355},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.41019999980926514},{"id":"https://openalex.org/C19444555","wikidata":"https://www.wikidata.org/wiki/Q212750","display_name":"Flattening","level":2,"score":0.3971000015735626},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.39169999957084656},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.37049999833106995},{"id":"https://openalex.org/C38349280","wikidata":"https://www.wikidata.org/wiki/Q1434290","display_name":"Flow (mathematics)","level":2,"score":0.35830000042915344},{"id":"https://openalex.org/C96147967","wikidata":"https://www.wikidata.org/wiki/Q190686","display_name":"Subroutine","level":2,"score":0.3253999948501587},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.29809999465942383},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.2913999855518341},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.28999999165534973},{"id":"https://openalex.org/C176359209","wikidata":"https://www.wikidata.org/wiki/Q2348963","display_name":"Control flow analysis","level":5,"score":0.28540000319480896},{"id":"https://openalex.org/C88468194","wikidata":"https://www.wikidata.org/wiki/Q1172416","display_name":"Data-flow analysis","level":3,"score":0.28450000286102295},{"id":"https://openalex.org/C527412718","wikidata":"https://www.wikidata.org/wiki/Q855395","display_name":"Interpretation (philosophy)","level":2,"score":0.2825999855995178},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.2775000035762787},{"id":"https://openalex.org/C162319229","wikidata":"https://www.wikidata.org/wiki/Q175263","display_name":"Data structure","level":2,"score":0.2759000062942505},{"id":"https://openalex.org/C3770464","wikidata":"https://www.wikidata.org/wiki/Q775963","display_name":"Smoothing","level":2,"score":0.2703000009059906},{"id":"https://openalex.org/C27458966","wikidata":"https://www.wikidata.org/wiki/Q1187693","display_name":"Control flow graph","level":2,"score":0.2678999900817871},{"id":"https://openalex.org/C140006998","wikidata":"https://www.wikidata.org/wiki/Q2499307","display_name":"Dynamic program analysis","level":3,"score":0.26759999990463257},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.26510000228881836}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tse.2026.3659437","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2026.3659437","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.4144023358821869,"id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G7454128159","display_name":null,"funder_award_id":"KRIT-CT-24-001","funder_id":"https://openalex.org/F2292562827","funder_display_name":"Korea Research Institute for Defense Technology Planning and Advancement"}],"funders":[{"id":"https://openalex.org/F2292562827","display_name":"Korea Research Institute for Defense Technology Planning and Advancement","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":24,"referenced_works":["https://openalex.org/W1509316335","https://openalex.org/W1964962870","https://openalex.org/W1994841870","https://openalex.org/W2007121005","https://openalex.org/W2024170198","https://openalex.org/W2142526507","https://openalex.org/W2163801980","https://openalex.org/W2171035369","https://openalex.org/W2175884749","https://openalex.org/W2293624369","https://openalex.org/W2314464932","https://openalex.org/W2532550198","https://openalex.org/W2614925308","https://openalex.org/W2768096314","https://openalex.org/W2953998016","https://openalex.org/W2983318410","https://openalex.org/W3023495226","https://openalex.org/W4247464060","https://openalex.org/W4288057809","https://openalex.org/W4295950666","https://openalex.org/W4320057401","https://openalex.org/W4400270714","https://openalex.org/W4401628931","https://openalex.org/W4403223305"],"related_works":[],"abstract_inverted_index":{"Control":[0],"Flow":[1],"Flattening":[2],"(CFF)":[3],"is":[4,97,108,205],"one":[5],"of":[6,21,99,126,137,161,190],"the":[7,18,58,63,76,124,135,147,167,171,188,191],"control":[8,14,174,183],"flow":[9,20,184],"obfuscation":[10,59,71,100],"techniques.":[11],"It":[12],"flattens":[13],"flows":[15],"to":[16,31,47,132,153,169,208],"conceal":[17],"sequential":[19],"programs.":[22,143],"Researchers":[23],"have":[24],"utilized":[25],"both":[26],"static":[27,93,111],"and":[28,62,165],"dynamic":[29],"approaches":[30],"deobfuscate":[32],"CFF.":[33],"Static":[34],"methods":[35],"primarily":[36],"rely":[37],"on":[38,57,75],"symbolic":[39],"execution,":[40],"which":[41,107,128],"leverages":[42],"pattern-based":[43],"information":[44],"from":[45],"CFF":[46],"perform":[48],"effective":[49],"analysis.":[50],"However,":[51],"these":[52],"patterns":[53],"can":[54],"vary":[55],"depending":[56],"tools":[60],"used,":[61],"deobfuscation":[64,94,125],"techniques":[65],"may":[66,83],"only":[67],"work":[68],"for":[69,123],"certain":[70],"tools.":[72],"Dynamic":[73],"approaches,":[74],"other":[77],"hand,":[78],"face":[79],"limitations":[80],"as":[81],"they":[82],"not":[84],"cover":[85],"all":[86,115],"possible":[87],"execution":[88,116,139],"paths.":[89,117],"We":[90,118,176],"propose":[91],"a":[92,109,197],"technique":[95,103,180],"that":[96,178,202],"independent":[98],"patterns.":[101],"Our":[102,144],"adopts":[104],"abstract":[105],"interpretation,":[106],"theoretical":[110],"analysis":[112,131,151],"framework":[113],"covering":[114],"define":[119],"k-switch":[120,148],"context":[121,149],"sensitivity":[122],"CFF,":[127],"enables":[129],"path-sensitive":[130],"accurately":[133],"identify":[134],"order":[136],"each":[138],"path":[140],"in":[141],"obfuscated":[142,156,192,209],"approach":[145],"utilizes":[146],"sensitive":[150],"result":[152],"divide":[154],"an":[155],"program":[157],"into":[158],"small":[159],"fragments":[160],"sequentially":[162],"executable":[163],"blocks":[164,168],"reassemble":[166],"reconstruct":[170],"program\u2019s":[172],"original":[173],"flows.":[175],"demonstrate":[177],"our":[179,203],"effectively":[181],"reduces":[182],"complexity":[185],"while":[186],"preserving":[187],"semantics":[189],"program.":[193],"Furthermore,":[194],"by":[195],"utilizing":[196],"binary":[198,210],"lifter,":[199],"we":[200],"show":[201],"method":[204],"also":[206],"applicable":[207],"code.":[211]},"counts_by_year":[],"updated_date":"2026-03-20T20:47:17.329874","created_date":"2026-02-01T00:00:00"}