面向安全强化的多层跳转控制流混淆框架

doi:10.3969/j.issn.1671-1122.2026.06.009

信息网络安全 ›› 2026, Vol. 26 ›› Issue (6): 958-966.doi: 10.3969/j.issn.1671-1122.2026.06.009

面向安全强化的多层跳转控制流混淆框架

王勇¹^,², 黄运军¹^,²(), 许凯¹^,²

¹ 桂林电子科技大学计算机与信息安全学院，桂林 541004
² 广西密码学与信息安全重点实验室，桂林 541004

收稿日期:2025-11-09 出版日期:2026-06-10 发布日期:2026-07-27
通讯作者: 黄运军 E-mail:1722321119@qq.com
作者简介:王勇（1977—），男，湖北，副研究员，硕士，主要研究方向为信息安全、密码学|黄运军（2000—），男，安徽，硕士研究生，主要研究方向为软件保护、信息安全|许凯（2001—），男，安徽，硕士研究生，主要研究方向为信息安全、区块链
基金资助:
国家自然科学基金(42164002)

A Multi-Layer Jump-Based Control Flow Obfuscation Framework for Security Enhancement

WANG Yong¹^,², HUANG Yunjun¹^,²(), XU Kai¹^,²

¹ School of Computer Science and Information Security, Guilin University of Electronic Technology, Guilin 541004, China
² Guangxi Key Laboratory of Cryptography and Information Security, Guilin 541004, China

Received:2025-11-09 Online:2026-06-10 Published:2026-07-27
Contact: HUANG Yunjun E-mail:1722321119@qq.com

摘要/Abstract

摘要：

针对软件在分发与运行过程中易遭受逆向分析、代码篡改及潜在攻击等多重安全威胁的问题。文章提出一种基于Gilbreath猜想的不透明谓词控制流混淆方法GE-FLO。该方法利用素数差序列构造不可预测的不透明谓词，并结合动态赋值与路径调度机制，在运行时引入不确定性，从而削弱控制流恢复与符号执行的有效性。实验结果表明，GE-FLO能有效诱导控制流结构复杂性数量级增长，同时降低符号执行分析效率，并导致高级静态分析工具功能部分失效。与现有方案相比，GE-FLO在提升混淆强度的同时保持了合理的运行开销，验证了其在实际安全防护场景中的优越性与实用性。

关键词: 控制流混淆, Gilbreath猜想, 动态赋值, 不透明谓词, 软件保护

Abstract:

To address the security threats such as reverse engineering, code tampering, and potential attacks during software distribution and execution, this paper proposes a control flow obfuscation method named GE-FLO, which is based on the Gilbreath conjecture. This method utilized sequences of prime differences to construct unpredictable opaque predicates and integrated dynamic assignment and path scheduling mechanisms to introduce runtime uncertainty, thereby undermining the effectiveness of control flow recovery and symbolic execution. Experimental results demonstrate that GE-FLO can effectively induce an order-of-magnitude increase in the complexity of control flow structures, significantly reduce the efficiency of symbolic execution analysis, and partially impair the functionality of advanced static analysis tools. Compared with existing solutions, GE-FLO enhances obfuscation strength while maintaining reasonable runtime overhead, validating its superiority and practical applicability in real-world security protection scenarios.

Key words: control flow obfuscation, opaque predicate, dynamic assignment, Gilbreath's conjecture, software protection

中图分类号:

TP309

王勇, 黄运军, 许凯. 面向安全强化的多层跳转控制流混淆框架[J]. 信息网络安全, 2026, 26(6): 958-966.

WANG Yong, HUANG Yunjun, XU Kai. A Multi-Layer Jump-Based Control Flow Obfuscation Framework for Security Enhancement[J]. Netinfo Security, 2026, 26(6): 958-966.

图/表 5

图1

表1

表2

表3

图2

参考文献 20

[1]	He Ning, Wu Lei, Wang Haoyu, et al. Characterizing Code Clones in the Ethereum Smart Contract Ecosystem[C]// Springer. International Conference on Financial Cryptography and Data Security. Heidelberg: Springer, 2020: 654-675.
[2]	ZREIKAT A I, ALARNAOUT Z, ABADLEH A, et al. The Integration of the Internet of Things (IoT) Applications into 5G Networks: A Review and Analysis[J]. Computers, 2025, 14(7): 250.
[3]	Wei Fengguo, Roy Sankardas, Ou Xinming, Robby, et al. Amandroid: A Precise and General Inter-Component Data Flow Analysis Framework for Security Vetting of Android Apps[J]. ACM Transactions on Privacy and Security (TOPS), 2018, 21(3): 1-32.
[4]	JUNOD P, RINALDINI J, WEHRLI J, et al. Obfuscator-LLVM--Software Protection for the Masses[C]// IEEE. 2015 Ieee/Acm 1st International Workshop on Software Protection. New York: IEEE, 2015: 3-9.
[5]	Wang Chenxi, HILL J, KNIGHT J, et al. Software Tamper Resistance: Obstructing Static Analysis of Programs[R]. Technical Report CS-2000-12, University of Virginia, 2000.
[6]	RAITSIS T, ELGAZARI Y, TOIBIN G E, et al. Code Obfuscation: A Comprehensive Approach to Detection, Classification, and Ethical Challenges[J]. Algorithms, 2025, 18(2): 54.
[7]	CHEN Yaoyang, CHEN Wei. Control Flow Obfuscation Technology Based on Implicit Jump[J]. Computer Engineering and Applications, 2021, 57(20): 125-132.
	陈耀阳, 陈伟. 采用隐式跳转的控制流混淆技术[J]. 计算机工程与应用, 2021, 57(20): 125-132.
[8]	Kenny Zhuo, LU Ming. Control flow obfuscation via CPS transformation[C]//ACM. The 2019 ACM SIGPLAN Workshop on Partial Evaluation and Program Manipulation (PEPM@POPL 2019), New York: ACM, 2019: 54-60.
[9]	CHEN Yindong, CHEN Wandong, HUANG Dancheng. An N-state opaque predicate obfuscation algorithm based on Henon map[J]. IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, 2025, E108-A(6): 870-873.
[10]	LE Deguang, ZHAO Jie, QIAN Zhenjiang. Control Flow Obfuscation Algorithm Based on Redundant Code[J]. Application Research of Computers, 2020, 37(11):3411-3416.
	乐德广, 赵杰, 钱振江. 基于冗余代码的控制流混淆算法[J]. 计算机应用研究, 2020, 37(11):3411-3416.
[11]	DEFREEZ D, THAKUR A V, RUBIO-GONZALEZ C. Path-based function embedding and its application to error-handling specification mining[C]//ACM. The 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. New York: ACM, 2018: 423-433.
[12]	JAMTHAGEN C, LANTZ P, HELL M. A New Instruction Overlapping Technique for Anti-Disassembly and Obfuscation of X86 Binaries[C]// IEEE. 2013 Workshop on Anti-Malware Testing Research. New York: IEEE, 2013: 1-9.
[13]	CARLINI N, BARRESI A, PAYER M, et al. Control-Flow Bending: on the Effectiveness of {Control-Flow} Integrity[C]// USENIX. The 24th USENIX Security Symposium (USENIX Security 2015). New York: USENIX, 2015: 161-176.
[14]	SEMENOV S, DAVYDOV V, VOLOSHYN D. Obfuscated Code Quality Measurement[C]// IEEE. 2019 XXIX International Scientific Symposium" Metrology and Metrology Assurance"(MMA). New York: IEEE, 2019: 1-6.
[15]	EBAD S A, DAREM A A, ABAWAJY J H. Measuring Software Obfuscation Quality-a Systematic Literature Review[J]. IEEE Access, 2021, 9: 99024-99038.
[16]	ARBOIT G. A method for watermarking Java programs via opaque predicates[C]//INFORMS. The Fifth International Conference on Electronic Commerce Research (ICECR-5). Montreal: INFORMS, 2002: 102-110.
[17]	WROBLEWSKI G. General Method of Program Code Obfuscation[J]. Ph. D. Thesis, Wroclaw University of Technology, Institute of Engineering Cybernetics, 2002: 117-129.
[18]	WROBLEWSKI G. General method of program code obfuscation[D]. Wroclaw: Wroclaw University of Technology, 2002.
[19]	SHAKOR M Y, KHALEEL M I, SAFRAN M, et al. Dynamic AES Encryption and Blockchain Key Management: a Novel Solution for Cloud Data Security[J]. IEEE Access, 2024, 12: 26334-26343.
[20]	LI Chengyang, HUANG Tianbo, CHEN Xiarun, et al. A Control Flow Obfuscation Scheme for LLVM Intermediate Representation[J]. Journal of Computer Engineering & Applications, 2023, 59(8): 263-269.
	李成扬, 黄天波, 陈夏润, 等. LLVM中间语言的控制流混淆方案[J]. 计算机工程与应用, 2023, 59(8):263-269.

序号	用例名称	算法类别	容量/KB	特征
1	AES-128	对称加密	2.4	高复杂度，多个S-Box替换函数
2	DES	对称加密	2.2	较小但包含多轮替换与置换
3	3DES	对称加密	1.4	DES的三轮复合，加倍控制流
4	RSA	非对称加密	1.5	模幂运算较复杂，分支较多
5	ElGamal	非对称加密	4.6	离散对数，含大整数乘模

混淆方案	代码块识别率	有效控制流边恢复率
原始程序	99.2%	98.1%
文献[4]方案	82.3%	76.8%
文献[19]方案	75.6%	68.9%
本文方案（GE-FLO）	36.7%	27.5%

混淆方案	路径探索覆盖率	符号状态总数	不透明谓词求解成功率
原始程序	95%	约1000	—
文献[4]方案	67%	约3500	83%
文献[19]方案	63%	约3200	79%
本文方案（GE-FLO）	小于5%	大于7000	小于15%

面向安全强化的多层跳转控制流混淆框架

A Multi-Layer Jump-Based Control Flow Obfuscation Framework for Security Enhancement

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 5

参考文献 20

相关文章 6

编辑推荐

Metrics

本文评价

[1]	刘培顺, 李心月, 陈平, 莫文青, 李双颖. 基于SGX的多关键字动态对称可搜索加密方案[J]. 信息网络安全, 2026, 26(6): 870-885.
[2]	文伟平, 方莹, 叶何, 陈夏润. 一种对抗符号执行的代码混淆系统[J]. 信息网络安全, 2021, 21(7): 17-26.
[3]	杜春来, 孔丹丹, 王景中, 谭兴邦. 一种基于指令虚拟化的代码保护模型[J]. 信息网络安全, 2017, 17(2): 22-28.
[4]	张晓, 李林, 许家乐, 刘念. 基于SMC的Android软件保护研究与实现[J]. 信息网络安全, 2014, 14(11): 74-78.
[5]	焦龙龙;罗森林. PE文件加壳技术研究与实现[J]. , 2013, 13(1): 0-0.
[6]	王玮. 一种基于USB Key加解密技术的软件保护方案研究[J]. , 2012, 12(5): 0-0.