# APIASO: A Novel API Call Obfuscation Technique Based on Address Space Obscurity
## 5 Experimental Evaluation
### Model Protection Strength Evaluation  
#### 5.1.1 The Obscurity Degree of API Address Space  
The obscurity degree of API address space is a key indicator of the effectiveness of API call obfuscation. To describe the ability of the obfuscation model to obfuscate the address space, we propose the concept of the obscurity degree of the API address space to quantitatively describe the degree of the obscurity of the API address space before and after obfuscation. Assuming that the program to be obfuscated is \(P\), the obfuscated program is represented as \(O(P)\). The obscurity degree of \(P\) is expressed as follows:  
\[APIASODegree(P)=\sum_{i}^{4}(-1)^{i-1}\frac{X_{i}-min(X_{i})}{max(X_{i})-min(X _{i})} \tag{5}\]  
\(X_{1}\)-\(X_{4}\) correspond to \(LevelPer(P)\), \(Cost(P)\), \(ComplexIncreaseR(P)\), and \(R(P)\), respectively. \(LevelPer(P)\) indicates the proportion of high-level functions in DLL space executed when the program calls the API. The higher the percentage of high-level functions, the more low-level functions are moved to the user code space and the higher the degree of address space obscurity. \(HighLevel(P)\) indicates the accessed high-level functions. \(Level(P)\) indicates the total number of levels of the program. The \(LevelPer(P)\) calculation process is expressed as follows:  
\[LevelPer(P)=\frac{HighLevel(P)}{Level(P)} \tag{6}\]  
\(Cost(P)\) denotes the cost of obfuscation of APIASO, which is expressed as the ratio of the number of functions moved to the total number of functions. \(MoveFun(P)\) denotes the number of functions moved. \(Fun(P)\) denotes the total number of APIs and their internal functions in the program. The \(Cost(P)\) calculation procedure is expressed as:  
\[Cost(P)=\frac{MoveFun(P)}{Fun(P)} \tag{7}\]  
\(ComplexIncreaseR(P)\) represents the rate of increase in the complexity of the API call process after obfuscation. The complexity of the API call process is measured by the complexity of the API call relationship graph. \(APICallComplex(P)\) represents the complexity of the program API call process, then the \(ComplexIncreaseR(P)\) calculation procedure is expressed as:  
\[ComplexIncreaseR(P)=\frac{APICallComplex(O(P))}{APICallComplex(P)} \tag{8}\]  
The program remains semantically equivalent before and after API call obfuscation, but it becomes more difficult for the analyst to understand it. Ideally, any means of API call obfuscation can be cracked given enough time. In practice, however, program reverse analysis does not always result in the same level of difficulty as understanding the original program. \(R(P)\) is expressed as the experience of the reverse analyst. The higher the experience of the analyst, the closer the result of the reverse analysis is to the original program, and the easier it is to understand the program. The similarity between the reverse analysis result and the original program in the API call space in terms of data flow and control flow is used as the evaluation basis. The higher the similarity, the closer the reverse analysis result is to the original program, and the higher the reverse analyst's experience \(R(P)\). \(P^{-1}\) denotes the result of reverse analysis; \(AC(P)\) and \(AD(P)\) denote the control flow and data flow of API call space, respectively; and \(R(P)\) denotes as follows:  
\[R(P)= Similarity\Big{[}AC(P),AC(P^{-1})\Big{]}+Similarity\Big{[}AD(P),AD(P^{-1} )\Big{]}. \tag{9}\]  
As described in Section 3.2, APIASO is a method to control the strength of obfuscation. The threshold set by the lower level function determines the number of functions to move when obfuscating. To verify the effect of obfuscation under different thresholds, the \(APIASODegree(P)\) is chosen as the judging basis for the obfuscation of six magnitudes of programs under Windows. In Figure 5, the magnitude I is represented as a program containing 20 APIs, and the magnitude I to VI programs are incremented by 10 APIs. Figure 5 represents the results of \(APIASODegree(P)\) versus execution time overhead for function levels set to 1, 2, 3, and 4.