一句话：提出基于运行时内存不变量的动态分析框架 JSidentify-V2，可抵抗深度混淆并高精度检测小游戏代码抄袭。
小游戏平台的爆发式增长伴随大量代码抄袭：攻击者获取热门游戏源码后稍作修改重新发布。现有静态分析工具只能识别变量重命名、死代码注入等简单混淆，对使用本地或云端密钥解密、彻底破坏代码结构的深度混淆几乎失效，AST 分析无从下手。本文提出 JSidentify-V2，其核心洞察是：混淆虽严重扭曲静态代码特征，但程序运行时的内存行为模式仍相对稳定。该框架采用四阶段流水线：静态预分析与插桩以识别潜在内存不变量；自适应热对象切片以最大化关键代码段的执行覆盖；构建内存依赖图作为抗混淆的行为指纹；基于图的相似度分析完成抄袭判定。作者在包含 1200 款小游戏的数据集上针对 8 种混淆方法进行评估，各混淆技术下相似度检测率均超过 90%，在基于解密的先进混淆下仍保持高准确率，而现有工具的检出率接近 0%。实际部署中达到 100% 精确率与 99.8% 召回率，较此前方法提速 8 倍，抄袭投诉下降逾 80%。
The explosive growth of mini-game platforms has led to widespread code plagiarism, where malicious users access popular games’ source code and republish them with modifications. While existing static analysis tools can detect simple obfuscation techniques like variable renaming and dead code injection, they fail against sophisticated deep obfuscation methods such as encrypted code with local or cloud-based decryption keys that completely destroy code structure and render traditional Abstract Syntax Tree analysis ineffective. To address these challenges, we present JSidentify-V2, a novel dynamic analysis framework that detects mini-game plagiarism by capturing memory invariants during program execution. Our key insight is that while obfuscation can severely distort static code characteristics, runtime memory behavior patterns remain relatively stable. JSidentify-V2 employs a four-stage pipeline: (1) static pre-analysis and instrumentation to identify potential memory invariants, (2) adaptive hot object slicing to maximize execution coverage of critical code segments, (3) Memory Dependency Graph construction to represent behavioral fingerprints resilient to obfuscation, and (4) graph-based similarity analysis for plagiarism detection.We evaluate JSidentify-V2 against eight obfuscation methods on a comprehensive dataset of 1,200 mini-games. Our framework achieves over 90% similarity detection across all tested obfuscation techniques, maintaining high accuracy even against advanced decryption-based methods where existing tools achieve near 0% detection rates. In real-world deployment, JSidentify-V2 achieves 100% precision and 99.8% recall while delivering an 8× speedup compared to previous methods. Our production deployment demonstrates that plagiarism complaints have decreased by over 80%, proving JSidentify-V2’s effectiveness in protecting intellectual property rights in mini-game ecosystems.
DOI 原文 ·
@inproceedings{paperbot9288,
title = {JSidentify-V2: Leveraging Dynamic Memory Fingerprinting for Mini-Game Plagiarism Detection},
author = {Zhihao Li and Chaozheng Wang and Zongjie Li and Xinyong Peng and Qun Xia and Haochuan Lu and Ting Xiong and Shuzheng Gao and Cuiyun Gao and Shuai Wang and Yuetang Deng and Huafeng Ma},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00257}
}