As software is getting more valuable, unauthorized users or malicious
programmers illegally copies and distributes copyrighted software over
online service provider (OSP) and P2P networks. To detect, block, and remove
pirated software (illegal programs) on OSP and P2P networks, this paper
proposes a new filtering approach using software birthmark, which is unique
characteristics of program and can be used to identify each program.
Software birthmark typically includes constant values, library information,
sequence of function calls, and call graphs, etc. We target Microsoft
Windows applications and utilize the numbers and names of DLLs and APIs
stored in a Windows executable file. Using that information and each
cryptographic hash value of the API sequence of programs, we construct
software birthmark database. Whenever a program is uploaded or downloaded on
OSP and P2P networks, we can identify the program by comparing software
birthmark of the program with birthmarks in the database. It is possible to
grasp to some extent whether software is an illegally copied one. The
experiments show that the proposed software birthmark can effectively
identify Windows applications. That is, our proposed technique can be
employed to efficiently detect and block pirated programs on OSP and P2P
networks.