检索结果-内蒙古大学图书馆

12th International Conference on Cloud Networking (CloudNet)

作者： Li, Zhenshan Liu, Hao Shan, Ruijie Sun, Yanbin Jiang, Yu Hu, Ning Guangzhou Univ Cyberspace Initiate Adv Technol Guangzhou Peoples R China Beijing Normal Univ Hong Kong Baptist Univ United Int Coll Zhuhai Peoples R China

ISBN: (纸本)9798350313062;9798350313079

binary code similarity detection (BCSD) is an important research direction in the field of computer network security. The application scenarios for BCSD are widespread and many related methods have been proposed to solve the problems of eliminating code redundancy, vulnerability mining, malware analysis, and code copyright protection. Based on the absence of a comprehensive overview of the BCSD method, the present article provides a review of the state of art on BCSD research. Firstly, this paper introduces the relevant concepts, general process, and challenges faced by BCSD, such as the compiler optimization diversity challenge. Secondly, based on different feature information and method principles, this paper classifies the current BCSD method into three categories: text-based, logic-based, and semantics-based methods. Then, the implementation procedures of multiple BCSD methods are described. Finally, this paper proposes prospects for the technology and application of BCSD.

关键词： network security feature extraction binary code similarity malware analysis

来源：评论

学校读者我要写书评

暂无评论

Unleashing the power of pseudo-code for binary code similarity analysis

引用

Cybersecurity 2023年第2期6卷 44-61页

作者： Weiwei Zhang Zhengzi Xu Yang Xiao Yinxing Xue School of Computer Science and Engineering University of Science and Technology of ChinaHefeiChina School of Computer Science and Engineering Nanyang Technological UniversitySingaporeSingapore Institute of Information Engineering Chinese Academy of SciencesBeijingChina School of Cyber Security University of Chinese Academy of SciencesBeijingChina

code similarity analysis has become more popular due to its significant applicantions,including vulnerability detection,malware detection,and patch *** the source code of the software is difficult to obtain under most circumstances,binary-level code similarity analysis(BCSA)has been paid much attention *** recent years,many BCSA studies incorporating Al techniques focus on deriving semantic information from binary functions with code representations such as assembly code,intermediate representations,and control flow graphs to measure the ***,due to the impacts of different compilers,architectures,and obfuscations,binaries compiled from the same source code may vary considerably,which becomes the major obstacle for these works to obtain robust *** this paper,we propose a solution,named UPPC(Unleashing the Power of Pseudo-code),which leverages the pseudo-code of binary function as input,to address the binary code similarity analysis challenge,since pseudocode has higher abstraction and is platform-independent compared to binary *** selectively inlines the functions to capture the full function semantics across different compiler optimization levels and uses a deep pyramidal convolutional neural network to obtain the semantic embedding of the *** evaluated UPPC on a data set containing vulnerabilities and a data set including different architectures(X86,ARM),different optimization options(O0-O3),different compilers(GCC,Clang),and four obfuscation *** experimental results show that the accuracy of UPPC in function search is 33.2%higher than that of existing methods.

关键词： binary code similarity Machine learning Software security Pseudo-code

来源：评论

学校读者我要写书评

暂无评论

A Survey of binary code similarity

引用

ACM COMPUTING SURVEYS 2022年第3期54卷 1–38页

作者： Ul Haq, Irfan Caballero, Juan Natl Univ Comp & Emerging Sci Islamabad Pakistan IMDEA Software Inst Madrid Spain

binary code similarityapproaches compare two or more pieces of binary code to identify their similarities and differences. The ability to compare binary code enables many real-world applications on scenarios where source code may not be available such as patch analysis, bug search, and malware detection and analysis. Over the past 22 years numerous binary code similarity approaches have been proposed, but the research area has not yet been systematically analyzed. This article presents the first survey of binary code similarity. It analyzes 70 binary code similarity approaches, which are systematized on four aspects: (1) the applications they enable, (2) their approach characteristics, (3) how the approaches are implemented, and (4) the benchmarks and methodologies used to evaluate them. In addition, the survey discusses the scope and origins of the area, its evolution over the past two decades, and the challenges that lie ahead.

关键词： binary code similarity code diffing code search cross-architecture executable

来源：评论

学校读者我要写书评

暂无评论

Multi-Level Cross-Architecture binary code similarity Metric

引用

ARABIAN JOURNAL FOR SCIENCE AND ENGINEERING 2021年第9期46卷 8603-8615页

作者： Qiao, Meng Zhang, Xiaochuan Sun, Huihui Shan, Zheng Liu, Fudong Sun, Wenjie Li, Xingwei State Key Lab Math Engn & Adv Comp Zhengzhou 450000 Peoples R China Natl Innovat Inst Def Technol Artificial Intelligence Res Ctr Beijing 100039 Peoples R China

Cross-architecture binary code similarity metric is a fundamental technique in many machine learning-based binary program analysis methods. Some researches recently utilize graph embedding methods to generate binary code embedding and regard Euclidean distance between two binary code as a similarity. However, these researches utilize manual features and do not make full use of binary code structure information, which causes the loss of binary code information. To solve above problems, we propose a multi-level neural network model to generate binary code embedding, which includes CFG(control flow graph) structure information and basic block information. We could measure the cross-architecture similarity through the Euclidean distance of binary code embedding. We conduct a series of experiments to compare the similarity of cross-architecture binary code, and the results demonstrate that our model can overcome the limitations described above and show superiority over the state-of-the-art methods.

关键词： binary code similarity Cross-architecture GCN Pseudo-siamese network

来源：评论

学校读者我要写书评

暂无评论

Strtune: Data Dependence-Based code Slicing for binary similarity Detection With Fine-Tuned Representation

引用

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 2024年 19卷 10233-10245页

作者： He, Kaiyan Hu, Yikun Li, Xuehui Song, Yunhao Zhao, Yubo Gu, Dawu Shanghai Jiao Tong Univ Sch Elect Informat & Elect Engn Shanghai 200025 Peoples R China

binary code similarity Detection (BCSD) is significant for software security as it can address binary tasks such as malicious code snippets identification and binary patch analysis by comparing code patterns. Recently, there has been a growing focus on artificial intelligence-based approaches in BCSD due to their scalability and generalization. Because binaries are compiled with different compilation configurations, existing approaches still face notable limitations when comparing binary similarity. First, BCSD requires analysis on code behavior, and existing work claims to extract semantic, but actually still makes analysis in terms of syntax. Second, directly extracting features from assembly sequences, existing work cannot address the issues of instruction reordering and different syntax expressions caused by various compilation configurations. In this paper, we propose STRTUNE, which slices binary code based on data dependence and perform slice-level fine-tuning. To address the first limitation, STRTUNE performs backward slicing based on data dependence to capture how a value is computed along the execution. Each slice reflects the collecting semantics of the code, which is stable across different compilation configurations. STRTUNE introduces flow types to emphasize the independence of computations between slices, forming a graph representation. To overcome the second limitation, based on slices corresponding to the same value computation but having different syntax representation, STRTUNE utilizes a Siamese Network to fine-tune such pairs, making their representations closer in the feature space. This allows the cross-graph attention to focus more on the matching of similar slices based on slice contents and flow types involved. Our evaluation results demonstrate the effectiveness and practicality of STRTUNE. We show that STRTUNE outperforms the state-of-the-art methods for BCSD, achieving a Recall@1 that is 25.3% and 22.2% higher than jTrans and GMN in the ta

关键词： Scalability Semantics Neural networks binary codes Syntactics Feature extraction Malware Security Optimization Faces binary code similarity data dependence code representation graph neural network

来源：评论

学校读者我要写书评

暂无评论

Directed grey box fuzzy testing for power terminal device firmware with intermediate representation similarity comparison

引用

JOURNAL OF INFORMATION SECURITY AND APPLICATIONS 2025年 90卷

作者： Qin, Zhongyuan Chen, Jiaqi Sun, Xin Song, Yubo Dai, Hua Chen, Weiwei Lv, Bang Wang, Kanghui Southeast Univ Sch Cyber Sci & Engn Nanjing Peoples R China State Grid Zhejiang Elect Power Co Ltd Res Inst Hangzhou Peoples R China

The proliferation of heterogeneous devices in power IoT terminals significantly increases security risks due to firmware vulnerabilities, thereby threatening the stability and reliability of power systems. However, existing Directed Greybox Fuzzing (DGF) methods face challenges, such as the need for manual identification of vulnerable code and limitations to specific architectures. This paper proposes a DGF approach, guided by intermediate representation similarity comparison, comprising two main components: objective function localization and directed greybox fuzzing. In the objective function localization phase, support for multiple architectures is achieved by lifting the binary code to LLVM Intermediate Representation (IR). Given that functions may vary in both structure and semantics, we represent functions using both structural and semantic features. We employ word embedding techniques based on Natural Language Processing (NLP) and graph neural network models to construct feature vectors. By calculating the feature similarity between each function and known vulnerable functions, we automatically identify highly similar functions as targets. In the directed greybox fuzzing phase, to address issues like high false positive rates and unreachable targets, we designed a target scheduling mechanism. This mechanism permanently blocks targets that have been sufficiently covered and periodically blocks those that have not been covered, thereby further improving the efficiency of fuzzing. Experimental results on two datasets demonstrate the effectiveness of this method in identifying vulnerabilities in power terminal equipment.

关键词： Directed grey box fuzzing(DGF) Intermediate representation(IR) binary code similarity Target scheduling mechanism Feature extraction Graph auto-encoder

来源：评论

学校读者我要写书评

暂无评论

DVul-WLG: Graph Embedding Network Based on code similarity for Cross-Architecture Firmware Vulnerability Detection 24th

DVul-WLG: Graph Embedding Network Based on Code Similarity f...

引用

24rd International Conference on Information Security (ISC)

作者： Sun, Hao Tong, Yanjun Zhao, Jing Gu, Zhaoquan Dalian Univ Technol Dalian Peoples R China Guangzhou Univ Guangzhou Peoples R China

ISBN: (纸本)9783030913564;9783030913557

Vulnerabilities in the firmware of embedded devices have led to many IoT security incidents. Embedded devices have multiple architectures and the firmware source code of embedded devices is difficult to obtain, which makes it difficult to detect firmware vulnerabilities. In this paper, we propose a neural network model called DVul-WLG for cross-architecture firmware vulnerability detection. This model analyzes the similarity between the binary function of the vulnerability and the binary function of the firmware to determine whether the firmware contains the vulnerability. The similarity between functions is calculated by comparing the features of the attribute control flow graph (ACFG) of the functions. DVul-WLG uses Word2vec, LSTM (Long Short-Term Memory) and an improved graph convolutional neural network (GCN) to extract the features of ACFG. This model embeds instructions of different architectures into the same space through canonical correlation analysis (CCA), and expresses instructions of different architectures in the form of intermediate vectors. In this way, the heterogeneity of architectures can be ignored when comparing cross-architecture similarity. We compared DVul-WLG with the advanced method FIT and the basic method Gemini through experiments. Experiments show that DVul-WLG has a higher AUC (Area Under the Curve) value. We also detected vulnerabilities in the real firmware. The accuracy of DVul-WLG is 89%, while FIT and Gemini are 78% and 73%, respectively.

关键词： Vulnerability detection binary code similarity Graph embedding

来源：评论

学校读者我要写书评

暂无评论

sem2vec: Semantics-aware Assembly Tracelet Embedding

引用

ACM TRANSACTIONS ON SOFTWARE ENGINEERING AND METHODOLOGY 2023年第4期32卷 1-34页

作者： Wang, Huaijin Ma, Pingchuan Wang, Shuai Tang, Qiyi Nie, Sen Wu, Shi Hong Kong Univ Sci & Technol Clear Water Bay Hong Kong Peoples R China Tencent Keen Secur Lab Tianlin Rd Shanghai Peoples R China

binary code similarity is the foundation of many security and software engineering applications. Recent works leverage deep neural networks (DNN) to learn a numeric vector representation (namely, embeddings) of assembly functions, enabling similarity analysis in the numeric space. However, existing DNN-based techniques capture syntactic-, control flow-, or data flow-level information of assembly code, which is too coarse-grained to represent program functionality. These methods can suffer from low robustness to challenging settings such as compiler optimizations and obfuscations. We present sem2vec, a binary code embedding framework that learns from semantics. Given the control-flow graph (CFG) of an assembly function, we divide it into tracelets, denoting continuous and short execution traces that are reachable from the function entry point. We use symbolic execution to extract symbolic constraints and other auxiliary information on each tracelet. We then train masked language models to compute embeddings of symbolic execution outputs. Last, we use graph neural networks, to aggregate tracelet embeddings into the CFG-level embedding for a function. Our evaluation shows that sem2vec extracts high-quality embedding and is robust against different compilers, optimizations, architectures, and popular obfuscation methods including virtualization obfuscation. We further augment a vulnerability search application with embeddings computed by sem2vec and demonstrate a significant improvement in vulnerability search accuracy.

关键词： Symbolic execution embedding graph neural network binary code similarity

来源：评论

学校读者我要写书评

暂无评论

ARCTURUS: Full Coverage binary similarity Analysis with Reachability-guided Emulation

引用

ACM TRANSACTIONS ON SOFTWARE ENGINEERING AND METHODOLOGY 2024年第4期33卷 1-31页

作者： Zhou, Anshunkang Hu, Yikun Xu, Xiangzhe Zhang, Charles Hong Kong Univ Sci & Technol Clear Water Bay Hong Kong Peoples R China Shanghai Jiao Tong Univ Shanghai Peoples R China Purdue Univ W Lafayette IN USA

binary code similarity analysis is extremely useful, since it provides rich information about an unknown binary, such as revealing its functionality and identifying reused libraries. Robust binary similarity analysis is challenging, as heavy compiler optimizations can make semantically similar binaries have gigantic syntactic differences. Unfortunately, existing semantic-based methods still suffer from either incomplete coverage or low accuracy. In this article, we propose ARCTURUS, a new technique that can achieve high code coverage and high accuracy simultaneously by manipulating program execution under the guidance of code reachability. Our key insight is that the compilermust preserve program semantics (e.g., dependences between code fragments) during compilation;therefore, the code reachability, which implies the interdependence between code, is invariant across code transformations. Based on the above insight, our key idea is to leverage the stability of code reachability to manipulate the program execution such that deep code logic can also be covered in a consistent way. Experimental results show that ARCTURUS achieves an average precision of 87.8% with 100% block coverage, outperforming compared methods by 38.4%, on average. ARCTURUS takes only 0.15 second to process one function, on average, indicating that it is efficient for practical use.

关键词： binary code similarity emulation reverse engineering program analysis

来源：评论

学校读者我要写书评

暂无评论

Novel supply chain vulnerability detection based on heterogeneous-graph-driven hash similarity in IoT

引用

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE 2023年 148卷 201-210页

作者： Ye, Guodong Liu, Xin Fan, Siqi Tan, Yuan Zhou, Qingguo Zhou, Rui Zhou, Xiaokang Lanzhou Univ Sch Informat Sci & Engn Lanzhou 730000 Peoples R China Shiga Univ Fac Data Sci Hikone 5220069 Japan RIKEN Ctr Adv Intelligence Project Tokyo 3510198 Japan

Supply chain vulnerability (SCV) exists in third-party components (operating systems, basic libraries, etc.). These vulnerabilities do not exist in code written by ordinary developers, who unknowingly introduce them due to the use of third-party components, resulting in the software they developed being affected by these vulnerabilities. Compared with traditional devices, IoT devices have various architectures, and the security issues introduced by code reuse are prominent. This paper proposes PhG-vNet, an effective and efficient SCV detection approach for IoT devices based on heterogeneous -graph-driven hash similarity. PhG-vNet uses customized graph embedding to feature the pseudo-code and uses the heterogeneous graph neural network to extract the graph structure to binary hash em-beddings. Then, PhG-vNet detects SCVs based on self-designed bit similarity with Bayesian weighted. Experiments show that PhG-vNet does not need expensive hardware requirements and has impressive low overhead and acceptable detection performance.& COPY;2023 Elsevier B.V. All rights reserved.

关键词： binary code similarity Supply chain vulnerability Heterogeneous graph Vulnerability detection

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：