# APIASO: A Novel API Call Obfuscation Technique Based on Address Space Obscurity
## 5 Experimental Evaluation
### Model Protection Strength Evaluation
#### 5.1.3 Sandbox and Antivirus Platform Detection  
Analysts often use the results of online sandbox detection as basics for further reverse analysis, while API calls are an essential metric in detection. In this section, programs protected by APIASO are analyzed using VirusTotal ([[https://www.virustotal.com/gui/home/upload](https://www.virustotal.com/gui/home/upload)]([https://www.virustotal.com/gui/home/upload](https://www.virustotal.com/gui/home/upload)), accessed on 13 August 2022), Cuckoo ([[https://cuckoosandbox.org/](https://cuckoosandbox.org/)]([https://cuckoosandbox.org/](https://cuckoosandbox.org/)), accessed on 13 August 2022), and Sandboxic ([[https://sandboxic-plus.com/](https://sandboxic-plus.com/)]([https://sandboxic-plus.com/](https://sandboxic-plus.com/)), accessed on 13 August 2022) to compare the differences in output results between platforms before and after obfuscation. We collect 100 publicly available malicious programs with source code from GitHub, then submit the obfuscated malicious programs to VirusTotal and Cuckoo to compare the difference in output results between platforms before and after obfuscation.  
VirusTotal uses a total of 78 different antivirus detection tools to mark submitted malicious programs as malicious or benign based on each security vendor's judgment; the more security vendors mark them as malicious, the less resistant the program is to analysis. The analysis results are shown in Figure 9. VirusTotal detects significantly fewer security vendors for obfuscated malicious programs due to APIASO obfuscating the API call information of malicious programs, with nearly half of the security vendors marking them as benign compared to before obfuscation.  
Cuckoo is a dynamic malicious program analysis sandbox that calculates a malicious rating for each submitted program based on the hit signature: less than 1.0 is benign, 1.0-2.0 is a warning, 2.0-5.0 is malicious, and above 5.0 is dangerous. Figure 10 Indicates the results of Cuckoo's detection. APIASO successfully reduced Cuckoo's score, with the obfuscation-protected programs all having malicious scores below 5.0 and significantly lower malicious behavior levels, all dropping below the malicious level.  
Figure 8: API deobfuscation Capability Radar Chart.  
We build Sandboxie in an experimental environment to run six API-weight programs after APIASO obfuscation. Sandboxie is a sandbox-based isolation program for Windows NT-based 32-bit and 64-bit operating systems. It was developed by [PERSON] since it was open sourced, and before that, it was developed by Sophos. It creates a sandbox-like isolated operating environment in which applications can be run or installed without permanent modification of local or mapped drives. Unobfuscatedly, the four programs are run in Sandboxie's isolated sandbox, and upon execution, an event log of that program's execution is generated, recording events such as file and registry operations. As a comparison, the API calls obfuscation techniques are applied to protect the above programs. The principle of the Sandboxie detecting API is to hook in the API area loaded by the system; when the program is executed, the API called will be recorded, so the method of position obfuscation cannot achieve the effect of API monitoring by hook monitoring. The results in Table 6 show that the program behavior under the protection of APIASO and position obfuscation cannot be captured, while several other obfuscation methods can be effectively observed in the event log.  
Figure 10: Cuckoo analysis results.  
Figure 9: VirusTotal analysis results.