NobleBlocks

Research indexJournal article

Adaptive LLVM-Based Code Obfuscation Using a Random Forest Selection Framework

Mateen

International Journal for Research in Applied Science and Engineering Technology28 Apr 2026Open access

NobleIDark:/48914/w1/20261004/AD11D787DOI10.22214/ijraset.2026.79512

Free to read at the publisher

You can read the abstract here, or the full text at the publisher.

Read at the publisher

Abstract

Compiled software distributed across open networks is under growing threat from advanced binary analysis instruments. Attackers equipped with disassemblers, decompilers, and symbolic execution platforms can reconstruct internal program logic, clone proprietary algorithms, and neutralise built-in security mechanisms without ever accessing the source. This work develops an adaptive obfuscation framework built on the Low-Level Virtual Machine infrastructure, targeting the platform-independent Intermediate Representation layer. A Random Forest classifier with one hundred decision trees analyses nine instruction-ratio features derived from each input program and autonomously assigns the most appropriate protection strategy from among four candidates: Control Flow Flattening, Instruction Substitution, XOR-based String Encryption, and All Passes Combined. The five-stage pipeline spans parsing, feature extraction, machine-learning-guided selection, pass application, and quantitative evaluation. Empirical testing across seven C programs yields instruction count growth of 94 to 118 per cent under control flow transformations, and byte entropy gains reaching 8.2 per cent when all passes execute together. The entire pipeline completes within two seconds, confirming suitability for continuous integration workflows. These outcomes demonstrate that LLVM constitutes a robust, portable, and extensible platform for intelligent compiler-level software protection.

Discussion

More

Suggest a correction or report