Software Identification Via Intrinsic Property Modelling for Cyber Security Enhancement

With the proliferation of software technologies across critical domains such as healthcare, manufacturing, and cybersecurity, reliable software identification mechanisms have become increasingly urgent. Traditional approaches, relying heavily on static code analysis, signature matching, and anomaly detection, are increasingly insufficient for classifying, identifying, and detecting sophisticated modifications, tampering, and environmental drift of software behaviours. Although the conventional machine learning approaches are deployed as an effective alternative, they are also associated with FP, which is a serious concern in the digital space. Therefore, as software evolves dynamically, those layers of security lose their validity, highlighting the necessity for more adaptive and intrinsic behaviour-based solutions. Recently, advanced malicious software often manipulates software behaviour during execution through subtle behavioural modifications, runtime subtle tampering, or subtle environmental drift, altering how the software operates, making it difficult to flag by the aforementioned defence mechanisms. This evolution highlights fundamental vulnerabilities in these solutions, underscoring the need for a more effective and dynamic approach. This research addresses these critical gaps by developing an effective and robust software identification method that distinguishes one software behaviour from modified or tampered variants, even under environmental variability such as machine reconfigurations or runtime state changes, rather than depending on static indicators. The proposed approach utilises dynamic execution metrics as intrinsic behavioural patterns, thereby enabling identification based on the software's behaviour rather than its coding structure. This thesis proposed the Algo-Metrics Identification approach, which integrates several advanced methodological components to achieve robustness, efficiency, scalability, and high accuracy. The proposed approach was trained and tested on nineteen dynamic intrinsic properties extracted from four algorithms, each with three versions from two hardware environments, totaling 228,000 samples. Comprehensive experimental validation was conducted to simulate real-world conditions that involve behavioural modifications, tampering, and environmental drift, and the experimental results indicate that the proposed approach has the lowest accuracy error of 0.95% and an F1-score error of 0.97%. This implies that the Algo-Metrics Software Identification has effectively identified software identity even under subtle modification scenarios. These findings confirm that intrinsic property modelling offers a robust and scalable solution to modern software identification challenges when combined with adaptive classification and dynamic spectral analysis. This research substantially strengthens software-driven infrastructures in an increasingly dynamic and threat-prone technological environment by enhancing the ability to identify, classify, and detect modification, tampering, behavioural drift, and runtime modifications.