# APIASO: A Novel API Call Obfuscation Technique Based on Address Space Obscurity
## 3 API Address Space obscurity Model
### API Name Clue Obfuscation  
API address space obscurity gets the API code at runtime, and the position of the API code in memory can be obtained by API name resolution. The current API call obfuscation uses a name resolution method where the API name is mapped to a fixed length hash by a hash function, and the program executes to resolve the required API address by hashing the hash operation, and then matching the hash value. The main problem with this method is that the hash function is fixed and does not guarantee a diverse range of hash functions for more secure API address resolution. To address the above problem, APIASO uses the more secure API name resolution method. To address the problem of using a single hash function, a hash function generator is designed to generate many fast and collision-free hash functions, and different API names are encrypted using different hash functions to ensure that a variety of hash functions are available. The details of this solution are described below. The hash function generator is used to generate many lightweight collision-free hash functions, providing a variety of options for the API name resolution. API names are represented as sets \(W=\{w_{1},w_{2},\ldots,w_{k}\}\) and the total number of API names is \(k\). The 64-bit hash generation space \(S\) takes values in the range \([0,2^{64}-1]\). We use a fast perfect hash function generation algorithm based on random graphs [20] to generate a hash function that satisfies the mapping of the set \(W\) to the hash value space \(S\) with no collisions, and the generic expression of the generated hash function is as follows:  
\[h(w)=g(f_{i}(w))+g(f_{j}(w)) \tag{4}\]  
where \(f_{i}\) and \(f_{j}\) are the operator functions that map the API names to the interval \([0,N-1]\), and \(N\) is the smallest integer that satisfies the collision-free hash function generation. G is the mapping function that maps the results of the operations of functions \(f_{i}\) and \(f_{j}\) to the hash value space \(S\). Given the set of operator functions \(F=\{f_{1},f_{2},\ldots,f_{i}\}\), the execution of the algorithm can find the mapping function \(g\). The specific algorithm execution process is as follows:  
1. An integer \(N\) greater than \(k\) is selected randomly, and two hash functions \(f_{i}\) and \(f_{j}\) from the set \(F\) are selected randomly afterward. 2. For each element \(w_{q}\) in the set \(W\), find \(f_{i}(w_{q})\) and \(f_{j}(w_{q})\). 3. An undirected graph \(G\) is created, of which the vertices are defined by \(f_{i}(w_{q})\) and \(f_{j}(w_{q})\). Then, each pair of vertices \(f_{i}(w_{q})\) and \(f_{j}(w_{q})\) are linked up to obtain graph edges, in which each edge corresponds to each element \(w_{q}\) of the set \(W\). 4. \(G\) is checked to see if it is acyclic, and if not, returns to Step 1. 5. \(N\) values are randomly selected in the hash generation space \(S\) and randomly assigned to the \(N\) edges of the graph \(G\) as the value of each element \(w_{q}\). 6. A randomly selected vertex is assigned a value of 0, and then a depth-first search is performed to traverse the graph \(G\) vertices. Correspondingly, the value of two vertices that share the same edge is assigned according to the hash value of this edge, such that the sum of the values of these two adjacent vertices equals to the hash value of the edge. 7. The sequence of vertices of the graph \(G\) and their assigned hash values form a mapping function \(g\). Thereby \(f_{i}\) and \(g\) constitute a collision-free hash function. The time complexity of this algorithm is \(O(N)\) and the space required to store the generated functions is \(O(N\log N)\) bits, which is optimal for generating perfect collision-free hash functions [21]. It is almost impossible to involve all the APIs in the program's API call process, so the size of the algorithm input \(k\) can be further optimized by adjusting \(k\) to the number of all API names in the DLL export table on which the program calls the APIs.