Software watermarking is a defense technique used to prevent or discourage software piracy by embedding a signature in the code. In ( Discrete Applied Mathematics 250 ( 2018 ) 145–164), a software watermarking system is presented which encodes an integer number w (i.e., a watermark) as a reducible permutation flow-graph [Formula: see text] embeddable in the code through the use of a self-inverting permutation [Formula: see text]. In this work, we theoretically investigate this watermarking system and exploit structural properties of the self-inverting permutation [Formula: see text] encoding the watermark in order to prove its resilience to edge-modification attacks on the flow-graph [Formula: see text]. Based on the minimum number of edge modifications needed to be applied on [Formula: see text] so that a different watermark can be extracted from the resulting graph, we give a characterization of the watermarks as strong, intermediate or weak and provide good recommendations for the choices of watermark.

In this paper we present a graph-based framework that, utilizing relations between groups of System-calls, detects whether an unknown software sample is malicious or benign, and classifies a malicious software to one of a set of known malware families. In our approach we propose a novel graph representation of dependency graphs by capturing their structural evolution over time constructing sequential graph instances, the so-called Temporal Graphs. The partitions of the temporal evolution of a graph defined by specific time-slots, results to different types of graphs representations based upon the information we capture across the capturing of its evolution. The proposed graph-based framework utilizes the proposed types of temporal graphs computing similarity metrics over various graph characteristics in order to conduct the malware detection and classification procedures. Finally, we evaluate the detection rates and the classification ability of our proposed graph-based framework conducting a series of experiments over a set of known malware samples pre-classified into malware families.