{"id":"https://openalex.org/W4415452668","doi":"https://doi.org/10.3390/make7040125","title":"Classification of Obfuscation Techniques in LLVM IR: Machine Learning on Vector Representations","display_name":"Classification of Obfuscation Techniques in LLVM IR: Machine Learning on Vector Representations","publication_year":2025,"publication_date":"2025-10-22","ids":{"openalex":"https://openalex.org/W4415452668","doi":"https://doi.org/10.3390/make7040125"},"language":"en","primary_location":{"id":"doi:10.3390/make7040125","is_oa":true,"landing_page_url":"https://doi.org/10.3390/make7040125","pdf_url":"https://www.mdpi.com/2504-4990/7/4/125/pdf?version=1761140063","source":{"id":"https://openalex.org/S4210213891","display_name":"Machine Learning and Knowledge Extraction","issn_l":"2504-4990","issn":["2504-4990"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Machine Learning and Knowledge Extraction","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2504-4990/7/4/125/pdf?version=1761140063","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5057376617","display_name":"Sebastian Raubitzek","orcid":"https://orcid.org/0000-0003-2206-9263"},"institutions":[{"id":"https://openalex.org/I4210167190","display_name":"SBA Research","ror":"https://ror.org/05nny6x17","country_code":"AT","type":"facility","lineage":["https://openalex.org/I4210167190"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Sebastian Raubitzek","raw_affiliation_strings":["SBA Research gGmbH, Floragasse 7/5.OG, 1040 Vienna, Austria"],"raw_orcid":"https://orcid.org/0000-0003-2206-9263","affiliations":[{"raw_affiliation_string":"SBA Research gGmbH, Floragasse 7/5.OG, 1040 Vienna, Austria","institution_ids":["https://openalex.org/I4210167190"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120100070","display_name":"Patrick Felbauer","orcid":"https://orcid.org/0009-0003-6488-8272"},"institutions":[{"id":"https://openalex.org/I129774422","display_name":"University of Vienna","ror":"https://ror.org/03prydq77","country_code":"AT","type":"education","lineage":["https://openalex.org/I129774422"]},{"id":"https://openalex.org/I4210105054","display_name":"Christian Doppler Laboratory for Thermoelectricity","ror":"https://ror.org/01cbw5x35","country_code":"AT","type":"facility","lineage":["https://openalex.org/I129774422","https://openalex.org/I145847075","https://openalex.org/I4210105054"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Patrick Felbauer","raw_affiliation_strings":["Christian Doppler Laboratory for Assurance and Transparency in Software Protection, Faculty of Computer Science, University of Vienna, Kolingasse 14\u201316, 1090 Vienna, Austria"],"raw_orcid":"https://orcid.org/0009-0003-6488-8272","affiliations":[{"raw_affiliation_string":"Christian Doppler Laboratory for Assurance and Transparency in Software Protection, Faculty of Computer Science, University of Vienna, Kolingasse 14\u201316, 1090 Vienna, Austria","institution_ids":["https://openalex.org/I4210105054","https://openalex.org/I129774422"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068988506","display_name":"Kevin Mallinger","orcid":"https://orcid.org/0000-0002-3031-505X"},"institutions":[{"id":"https://openalex.org/I4210167190","display_name":"SBA Research","ror":"https://ror.org/05nny6x17","country_code":"AT","type":"facility","lineage":["https://openalex.org/I4210167190"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Kevin Mallinger","raw_affiliation_strings":["SBA Research gGmbH, Floragasse 7/5.OG, 1040 Vienna, Austria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"SBA Research gGmbH, Floragasse 7/5.OG, 1040 Vienna, Austria","institution_ids":["https://openalex.org/I4210167190"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5055367812","display_name":"Sebastian Schrittwieser","orcid":"https://orcid.org/0000-0003-2115-2022"},"institutions":[{"id":"https://openalex.org/I129774422","display_name":"University of Vienna","ror":"https://ror.org/03prydq77","country_code":"AT","type":"education","lineage":["https://openalex.org/I129774422"]},{"id":"https://openalex.org/I4210105054","display_name":"Christian Doppler Laboratory for Thermoelectricity","ror":"https://ror.org/01cbw5x35","country_code":"AT","type":"facility","lineage":["https://openalex.org/I129774422","https://openalex.org/I145847075","https://openalex.org/I4210105054"]}],"countries":["AT"],"is_corresponding":true,"raw_author_name":"Sebastian Schrittwieser","raw_affiliation_strings":["Christian Doppler Laboratory for Assurance and Transparency in Software Protection, Faculty of Computer Science, University of Vienna, Kolingasse 14\u201316, 1090 Vienna, Austria"],"raw_orcid":"https://orcid.org/0000-0003-2115-2022","affiliations":[{"raw_affiliation_string":"Christian Doppler Laboratory for Assurance and Transparency in Software Protection, Faculty of Computer Science, University of Vienna, Kolingasse 14\u201316, 1090 Vienna, Austria","institution_ids":["https://openalex.org/I4210105054","https://openalex.org/I129774422"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5055367812"],"corresponding_institution_ids":["https://openalex.org/I129774422","https://openalex.org/I4210105054"],"apc_list":{"value":1400,"currency":"CHF","value_usd":1515},"apc_paid":{"value":1400,"currency":"CHF","value_usd":1515},"fwci":1.0044,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.81500852,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":98},"biblio":{"volume":"7","issue":"4","first_page":"125","last_page":"125"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.7919999957084656,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.7919999957084656,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14319","display_name":"Currency Recognition and Detection","score":0.7612000107765198,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.652899980545044},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.49540001153945923},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.48559999465942383},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.4564000070095062},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.4401000142097473},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.42820000648498535},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4205999970436096},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.3822999894618988}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8422999978065491},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.652899980545044},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.61080002784729},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5600000023841858},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.49540001153945923},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.48559999465942383},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.4564000070095062},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.4401000142097473},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.42820000648498535},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4205999970436096},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.3822999894618988},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.37229999899864197},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.33889999985694885},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3319999873638153},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.3257000148296356},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.30660000443458557},{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.28600001335144043},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.2766999900341034},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.272599995136261},{"id":"https://openalex.org/C519991488","wikidata":"https://www.wikidata.org/wiki/Q28865","display_name":"Python (programming language)","level":2,"score":0.27219998836517334},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.2680000066757202},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.26170000433921814}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/make7040125","is_oa":true,"landing_page_url":"https://doi.org/10.3390/make7040125","pdf_url":"https://www.mdpi.com/2504-4990/7/4/125/pdf?version=1761140063","source":{"id":"https://openalex.org/S4210213891","display_name":"Machine Learning and Knowledge Extraction","issn_l":"2504-4990","issn":["2504-4990"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Machine Learning and Knowledge Extraction","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:a8d08321148e4462b2e5ceebb0c41104","is_oa":true,"landing_page_url":"https://doaj.org/article/a8d08321148e4462b2e5ceebb0c41104","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Machine Learning and Knowledge Extraction, Vol 7, Iss 4, p 125 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/make7040125","is_oa":true,"landing_page_url":"https://doi.org/10.3390/make7040125","pdf_url":"https://www.mdpi.com/2504-4990/7/4/125/pdf?version=1761140063","source":{"id":"https://openalex.org/S4210213891","display_name":"Machine Learning and Knowledge Extraction","issn_l":"2504-4990","issn":["2504-4990"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Machine Learning and Knowledge Extraction","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320323591","display_name":"Christian Doppler Forschungsgesellschaft","ror":"https://ror.org/00mv8h305"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4415452668.pdf","grobid_xml":"https://content.openalex.org/works/W4415452668.grobid-xml"},"referenced_works_count":17,"referenced_works":["https://openalex.org/W1996350342","https://openalex.org/W2056132907","https://openalex.org/W2069123635","https://openalex.org/W2511120801","https://openalex.org/W2560204201","https://openalex.org/W2734558754","https://openalex.org/W2789879105","https://openalex.org/W2887787078","https://openalex.org/W3086481683","https://openalex.org/W3211159634","https://openalex.org/W4247464060","https://openalex.org/W4251889484","https://openalex.org/W4376129977","https://openalex.org/W4388477849","https://openalex.org/W4392639644","https://openalex.org/W4400577082","https://openalex.org/W4406678333"],"related_works":[],"abstract_inverted_index":{"We":[0,15,55,129],"present":[1],"a":[2,42,90,116,165],"novel":[3],"methodology":[4],"for":[5,150,160,184],"classifying":[6],"code":[7,20,25,39,75,170],"obfuscation":[8,104,199],"techniques":[9],"in":[10,138,205],"LLVM":[11,33],"IR":[12,38,169],"program":[13],"embeddings.":[14],"apply":[16],"isolated":[17],"and":[18,35,85,108,122,156,189,193],"layered":[19,154,206],"obfuscations":[21,204],"to":[22,32,62],"C":[23],"source":[24,74],"using":[26],"the":[27,52,73,77,97,126,140,175,182,191],"Tigress":[28],"obfuscator,":[29],"compile":[30],"them":[31],"IR,":[34],"convert":[36],"each":[37],"representation":[40,167],"into":[41,99],"numerical":[43],"embedding":[44],"(vector":[45],"representation)":[46],"that":[47,95,164],"captures":[48],"intrinsic":[49],"characteristics":[50],"of":[51,68,119,134,142,168,174],"applied":[53],"obfuscations.":[54,143],"then":[56],"use":[57],"two":[58],"modern":[59],"boost":[60],"classifiers":[61],"identify":[63],"which":[64],"obfuscation,":[65],"or":[66],"layering":[67],"obfuscations,":[69,152,155,186],"was":[70],"used":[71],"on":[72],"from":[76],"vector":[78,166],"representation.":[79],"To":[80],"better":[81],"analyze":[82],"classifier":[83],"behavior":[84],"error":[86],"propagation,":[87],"we":[88,180,194],"employ":[89],"staged,":[91],"cascading":[92],"experimental":[93],"design":[94],"separates":[96],"task":[98],"multiple":[100],"decision":[101],"levels,":[102],"including":[103,153],"detection,":[105],"single-versus-layered":[106],"discrimination,":[107],"detailed":[109],"technique":[110],"classification.":[111],"This":[112],"structured":[113],"evaluation":[114],"allows":[115],"fine-grained":[117],"view":[118],"classification":[120,148],"uncertainty":[121],"model":[123],"robustness":[124],"across":[125],"inference":[127],"stages.":[128],"achieve":[130],"an":[131],"overall":[132],"accuracy":[133,149],"more":[135],"than":[136],"90%":[137],"identifying":[139],"types":[141],"Our":[144],"experiments":[145],"show":[146],"high":[147],"most":[151],"even":[157],"perfect":[158],"scores":[159],"certain":[161],"transformations,":[162],"indicating":[163],"preserves":[171],"distinguishing":[172],"features":[173],"protections.":[176],"In":[177],"this":[178],"article,":[179],"detail":[181],"workflow":[183],"applying":[185],"generating":[187],"embeddings,":[188],"training":[190],"model,":[192],"discuss":[195],"challenges":[196],"such":[197],"as":[198],"patterns":[200],"covered":[201],"by":[202],"other":[203],"protection":[207],"scenarios.":[208]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-24T00:00:00"}