# A Framework to Quantify the Quality of Source Code Obfuscation
## 2 Background
### Dataset for Evaluating Source Code Obfuscation  
Assessing obfuscation quality requires a dataset encompassing a broad spectrum of software characteristics and complexities. Such datasets typically comprise various source codes in various programming languages, ranging from simple scripts to complex, multi-module applications. This diversity ensures that the effectiveness of obfuscation techniques can be tested across a wide range of coding styles, structures, and functions. Additionally, the dataset should include examples with varying levels of initial readability and clarity, as this factor can impact the extent to which code can be obfuscated. Additionally, annotated code versions may be included, highlighting key features such as control flow, data structures, and algorithmic logic. This facilitates a before-and-after comparison of the obfuscation process. Evaluation metrics for the dataset may include readability scores, complexity measures, and resilience against reverse engineering tools and techniques. Therefore, an ideal dataset for evaluating obfuscation quality should be comprehensive, diverse, and rich in metadata to enable a thorough and nuanced analysis of obfuscation effectiveness. The NIST Juliet Test Suite is an extensive compilation of test cases created by the National Institute of Standards and Technology (NIST) to assess how well different software tools detect vulnerabilities. This dataset has been meticulously curated to encompass a broad spectrum of typical coding errors that are known to result in potential security vulnerabilities; this is in line with the classifications established by the Common Weakness \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Obfuscators** & **Options** & **Obfuscation Techniques** & **Obfuscator Type** \\ \hline \multirow{3}{*}{Stunnix C/C++ Obfuscator} & \multicolumn{3}{c}{protect everything but leave symbol names as is} \\ \cline{3-4}  & & Change Formatting & \\ \cline{3-4}  & & Remove Comments & \\ \cline{3-4}  & & Instruction Substitution & \\ \hline \multirow{3}{*}{Semantic Designs C-CCC4 Obfuscator} & \multicolumn{3}{c}{Scramble Identifiers} \\ \cline{3-4}  & +PrintAsis & Change Formatting & \\ \cline{3-4}  & +Obfuscate & Remove Comments & \\ \cline{3-4}  & +ObfuscateLiterals & Data Encoding & \\ \hline \multirow{3}{*}{Tigress Obfuscator} & Level 1: Enc.Arithmetic and Add Opaque & Mixed Boolean Arithmetic & \\ \cline{3-4}  & \multicolumn{1}{c}{Level 2: Enc.Arithmetic and Add Opaque} & \multicolumn{1}{c}{} & \\ \cline{3-4}  & \multicolumn{1}{c}{Level 3: Enc.Arithmetic and Add Opaque} & \multicolumn{1}{c}{} & \\ \cline{3-4}  & \multicolumn{1}{c}{Level 3: Enc.Arithmetic and Add Opaque and Flatten} & \multicolumn{1}{c}{} & \\ \cline{3-4}  & \multicolumn{1}{c}{Control Flow Flattening} & \multicolumn{1}{c}{} & \\ \cline{3-4}  & \multicolumn{1}{c}{Control Flow Flattening} & \multicolumn{1}{c}{} & \\ \cline{3-4}  & \multicolumn{1}{c}{Control Flow Flattening} & \multicolumn{1}{c}{} & \\ \cline{3-4}  & \multicolumn{1}{c}{Instruction Substitution} & \multicolumn{1}{c}{} & \\ \cline{3-4}  & \multicolumn{1}{c}{Bogus Control Flows} & \multicolumn{1}{c}{} & \\ \cline{3-4}  & \multicolumn{1}{c}{Control Flow Flattening} & \multicolumn{1}{c}{} & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The following details the obfuscation tools used in the experiments, summarizing each tool’s options and obfuscation techniques. Enumeration (CWE) system. The NIST Juliet Test Suite (version 1.3) comprises thousands of test cases in various programming languages, including C, C++, Java, and C#. Each test case in the Juliet Test Suite is carefully crafted to simulate a distinct vulnerability type, encompassing scenarios like buffer overflows, SQL injections, cross-site scripting, and inadequate input validation. These test cases are accompanied by comprehensive annotations and are systematically structured to allow automated tools to perform processing and analysis by automated tools efficiently.