A Dynamic Birthmark for Java

Abstract. Code theft is a threat for companies that considers code as a core asset. A birthmark can help them to prove code theft by identifying intrinsic properties of a program. Two programs with the same birthmark are likely to share a common origin. Birthmarking works in particular for code that was not protected by tamper-resistant copyright notices that otherwise could prove ownership. We propose a dynamic birthmark for Java that observes how a program uses objects provided by the Java Standard API. Such a birthmark is difficult to foil because it captures the observable semantics of a program. In an evaluation, our API Birthmark reliably identified XML parsers and PNG readers before and after obfuscating them with state-of-the-art obfuscation tools. These rendered existing birthmarks ineffective, such as the Whole-Program-Path Birthmark by Myles and Collberg.