检索结果-内蒙古大学图书馆

19th ACM Asia Conference on Computer and Communications Security (ACM AsiaCCS)

作者： Maier, Alwin Weissberg, Felix Rieck, Konrad Max Planck Inst Solar Syst Res Gottingen Germany Tech Univ Berlin Berlin Germany BIFOLD Berlin Germany

ISBN: (纸本)9798400704826

Deep learning has enabled remarkable progress in binary code analysis. In particular, pre-trained embeddings of assembly code have become a gold standard for solving analysis tasks, such as measuring code similarity or recognizing functions. These embeddings are capable of learning a vector representation from unlabeled code. In contrast to natural language processing, however, label information is not scarce for many tasks in binary code analysis. For example, labeled training data for function boundaries, optimization levels, and argument types can be easily derived from debug information provided by a compiler. Consequently, the main motivation of embeddings does not transfer directly to binary code analysis. In this paper, we explore the role of pre-trained embeddings from a critical perspective. To this end, we systematically evaluate recent embeddings for assembly code on five downstream tasks using a corpus of 1.2 million functions from the Debian distribution. We observe that several embeddings perform similarly when sufficient labeled data is available, and that differences reported in prior work are hardly noticeable. Surprisingly, we find that end-to-end learning without pre-training performs best on average, which calls into question the need for specialized embeddings. By varying the amount of labeled data, we eventually derive guidelines for when embeddings offer advantages and when end-to-end learning is preferable for binary code analysis.

关键词： Transfer learning binary code analysis

来源：评论

学校读者我要写书评

暂无评论

binary code analysis

引用

COMPUTER 2013年第8期46卷 60-68页

作者： Liu, Kaiping Tan, Hee Beng Kuan Chen, Xu Nanyang Technol Univ Temasek Labs Singapore 639798 Singapore Nanyang Technol Univ Sch Elect & Elect Engn Informat Engn Div Singapore 639798 Singapore Chinese Acad Sci Inst Comp Technol Beijing Peoples R China

Static and dynamic analysis of binary code can provide useful information to security researchers without access to assembly code. However, these approaches currently require separate tools, forcing users to perform d... 详细信息

关键词： binary codes Assembly Memory Management Software Engineering Malware binary Executables binary code analysis Static analysis Dynamic analysis

来源：评论

学校读者我要写书评

暂无评论

FUNPROBE: Probing Functions from binary code through Probabilistic analysis 2023

FUNPROBE: Probing Functions from Binary Code through Probabi...

引用

31st ACM Joint Meeting of the European Software Engineering Conference / Symposium on the Foundations-of-Software-Engineering (ESEC/FSE)

作者： Kim, Soomin Kim, Hyungseok Cha, Sang Kil Korea Adv Inst Sci & Technol SoftSec Lab Seoul South Korea

ISBN: (纸本)9798400703270

Current function identification techniques have been mostly focused on a specific set of binaries compiled for a specific CPU architecture. While recent deep-learning-based approaches theoretically can handle binaries from different architectures, they require significant computation resources for training and inference, making their use less practical. Furthermore, due to the lack of interpretability of such models, it is fundamentally difficult to gain insight from them. Hence, in this paper, we propose FUNPROBE, an efficient system for identifying functions from binaries using probabilistic inference. In particular, we identify 16 architecture-neutral hints for function identification, and devise an effective method to combine them in a probabilistic framework. We evaluate our tool on a large dataset consisting of 19,872 real-world binaries compiled for six major CPU architectures. The results are promising. FUNPROBE shows the best accuracy compared to five state-of-the-art tools we tested, while it takes only 6 seconds on average to analyze a single binary. Notably, FUNPROBE is 6x faster on average in identifying functions than XDA, a state-of-the-art deep-learning tool that leverages GPU in its inference phase.

关键词： binary code analysis function identification probabilistic analysis

来源：评论

学校读者我要写书评

暂无评论

Identifying runtime libraries in statically linked linux binaries

引用

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE 2025年 164卷

作者： Carrillo-Mondejar, Javier Rodriguez, Ricardo J. Univ Zaragoza Dept Informat & Ingn Sistemas Zaragoza Spain Aragon Inst Engn Res I3A Aragon Spain

Vulnerabilities in unpatched applications can originate from third-party dependencies in statically linked applications, as they must be relinked each time to take advantage of libraries that have been updated to fix any vulnerability. Despite this, malware binaries are often statically linked to ensure they run on target platforms and to complicate malware analysis. In this sense, identification of libraries in malware analysis becomes crucial to help filter out those library functions and focus on malware function analysis. In this paper, we introduce MANTILLA, a system for identifying runtime libraries in statically linked Linux-based binaries. Our system is based on radare2 to identify functions and extract their features (independent of the underlying architecture of the binary) through static binary analysis and on the K-nearest neighbors supervised machine learning model and a majority rule to predict final values. MANTILLA is evaluated on a dataset consisting of binaries built for different architectures (MIPSeb, ARMel, Intel x86, and Intel x86-64) and different runtime libraries (uClibc, glibc, and musl), achieving very high accuracy. We also evaluate it in two case studies. First, using a dataset of binary files belonging to the binutils collection and second, using an IoT malware dataset. In both cases, good accuracy results are obtained both in terms of runtime library detection (94.4% and 95.5%, respectively) and architecture identification (100% and 98.6%, respectively).

关键词： binary code analysis Statically linked binaries Runtime library identification IoT Malware

来源：评论

学校读者我要写书评

暂无评论

Compiler-provenance identification in obfuscated binaries using vision transformers

引用

FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION 2024年 49卷

作者： Khan, Wasif Alrabaee, Saed Al-kfairy, Mousa Tang, Jie Choo, Kim-Kwang Raymond United Arab Emirates Univ Informat Syst Secur Al Ain 15551 U Arab Emirates Zayed Univ Coll Technol Innovat Abu Dhabi U Arab Emirates Tsinghua Univ Dept Comp Sci Beijing Peoples R China Univ Texas San Antonio Dept Informat Syst & Cyber Secur San Antonio TX USA United Arab Emirates Univ Big Data Analyt Ctr Al Ain 15551 U Arab Emirates United Arab Emirates Univ Coll IT Cybersecur Res Grp Ctr Al Ain 15551 U Arab Emirates

Extracting compiler-provenance-related information (e.g., the source of a compiler, its version, its optimization settings, and compiler-related functions) is crucial for binary-analysis tasks such as function fingerprinting, detecting code clones, and determining authorship attribution. However, the presence of obfuscation techniques has complicated the efforts to automate such extraction. In this paper, we propose an efficient and resilient approach to provenance identification in obfuscated binaries using advanced pre-trained computer-vision models. To achieve this, we transform the program binaries into images and apply a two-layer approach for compiler and optimization prediction. Extensive results from experiments performed on a large-scale dataset show that the proposed method can achieve an accuracy of over 98 % for both obfuscated and deobfuscated binaries.

关键词： Reverse engineering Compiler provenance binary code analysis Malware analysis

来源：评论

学校读者我要写书评

暂无评论

LIFTFUZZ: Validating binary Lifters through Context-aware Fuzzing with GPT 24

LIFTFUZZ: Validating Binary Lifters through Context-aware Fu...

引用

31st Conference on Computer and Communications Security

作者： Zhou, Yutong Yang, Fan Song, Zirui Zhang, Ke Chen, Jiongyi Zhang, Kehuan Chinese Univ Hong Kong Hong Kong Peoples R China

ISBN: (纸本)9798400706363

Analyzing binary code is vital for software engineering and security research, particularly when the source code is unavailable. However, understanding, modifying, and retargeting binary code can be complex tasks. To counter these difficulties, binary lifters have been introduced. These tools translate binary code into Intermediate Representations (IRs), providing several advantages, such as enabling modifications to executables without source code and facilitating code retargetability. So far, accurately developing binary lifters for modern ISAs is universally acknowledged as challenging and errorprone. Existing validation methods mainly concentrate on isolated instructions, overlooking interactions among instructions. In this paper, we introduce LIFTFUZZ, a novel framework that leverages instruction context-aware fuzzing to validate binary lifters. LIFTFUZZ harnesses an assembly language model to learn interactions among instructions and generates test cases with the knowledge. LIFTFUZZ greatly outperforms the baseline, requiring only 1/1000 of the test cases used by the baseline to identify 26 inconsistencies, including a previously uncovered category. LIFTFUZZ significantly contributes to enhancing the performance of binary lifters, which are frequently employed in binary security applications.

关键词： binary code analysis binary Lifter Fuzzing Machine Learning

来源：评论

学校读者我要写书评

暂无评论

Are We There Yet? Filling the Gap Between binary Similarity analysis and binary Software Composition analysis 9

Are We There Yet? Filling the Gap Between Binary Similarity ...

引用

9th IEEE European Symposium on Security and Privacy (EuroS and P)

作者： Wang, Huaijin Liu, Zhibo Wang, Shuai Wang, Ying Tang, Qiyi Nie, Sen Wu, Shi Hong Kong Univ Sci & Technol Hong Kong Peoples R China Northeastern Univ Shenyang Peoples R China Tencent Keen Secur Lab Shenzhen Peoples R China

ISBN: (纸本)9798350354263;9798350354256

Software composition analysis (SCA) has attracted the attention of the industry and academic community in recent years. Given a piece of program source code, SCA facilitates extracting certain components from the input program and matching the extracted components with open-source software (OSS) libraries. Despite the prosperous development of SCA, binary SCA (BSCA) is highly challenging and still underdeveloped. Few available BSCA solutions are either closed source (for commercial usage) or suffer from low performance. Nevertheless, a related line of research, binary similarity analysis (BSA), which decides the similarity between two pieces of binary code, has been progressively developed in academia for decades. De facto BSA techniques, often based on deep learning, efficiently analyze large-scale executables with high accuracy. This study explores bridging the gap between state-of-the-art (SOTA) BSA and BSCA. We spent considerable manual effort building the first large real-world benchmark dataset, containing over 55 million lines of C/C++ code. Then, we establish our BSCA pipeline by extending and calibrating the SOTA SCA pipeline. Particularly, we concretize the key procedure of BSCA, namely matching a binary component with OSS using six SOTA BSA techniques. Evaluation using our benchmark dataset reveals that simply employing BSA in BSCA exhibits less desirable accuracy, as BSCA faces unique challenges. After inspecting the failed cases, we propose three enhancements whose hybrid usage improves the F1 score of BSCA by over 30% and outperforms SOTA commercial BSCA software. Our experiment on 1-day vulnerability detection demonstrates our BSCA framework's effectiveness. We also discuss several open challenges and potential solutions to augment BSCA solutions.

关键词： binary code analysis binary similarity analysis Software composition analysis Software reuse Vulnerability detection

来源：评论

学校读者我要写书评

暂无评论

Return Instruction Classification in binary code Using Machine Learning

引用

INTERNATIONAL JOURNAL OF SOFTWARE ENGINEERING AND KNOWLEDGE ENGINEERING 2022年第9期32卷 1419-1452页

作者： Qiu, Jing Geng, Xiaoxu Dong, Feng Zhejiang A&F Univ Hangzhou 311300 Peoples R China Harbin Univ Sci & Technol Harbin 1500010 Peoples R China

binary code analysis is vital in source code unavailable cases, such as malware analysis and software vulnerability mining. Its first step could be function identification. Most function identification methods are based on function prologs/epilogs. However, functions may not have standard prologs/epilogs. To identify these functions, we need to use other methods. One approach is to identify return instructions first and then identify the start of a function. Currently, the multi-layer perceptron model is exploited to identify and validate a return instruction at a specific location. On this basis, a new approach is proposed to improve accuracy and provide more details. Specifically, a return instruction is classified into three classes: (1) false return instruction, (2) true return instruction inner a function but not the last instruction, and (3) true return instruction at the end of a function. The evaluation is performed on 5782 real-world binaries. Meanwhile, common classifiers including fully connected neural network, Two-layer Bidirectional Recurrent Neural Network (TBRNN), Two-layer Bidirectional Gate Recurrent Unit (TBGRU), Two-layer Bidirectional Long Short-term Memory Network (TBLSTM), Decision Tree, Random Forest, XGBoost, and Support Vector Machine (SVM) are evaluated on the same data set. The result shows that TBLSTM achieves an accuracy of 99.78%, which is higher than that of other classifiers in the evaluation, including the state-of-the-art tool IDA Pro 7.7.

关键词： Return instruction classification function identification binary code analysis reverse engineering machine learning

来源：评论

学校读者我要写书评

暂无评论

Guiding Symbolic Execution with A-Star 21st

Guiding Symbolic Execution with A-Star

引用

21st International Workshop on Software Engineering and Formal Methods (SEFM)

作者： Pinto, Theo De Castro Rollet, Antoine Sutre, Gregoire Tobor, Ireneusz Univ Bordeaux LaBRI Bordeaux INP CNRSUMR 5800 F-33400 Talence France Serma Safety & Secur F-33600 Pessac France

ISBN: (纸本)9783031471148;9783031471155

Symbolic execution is widely used to detect vulnerabilities in software. The idea is to symbolically execute the program in order to find an executable path to a target instruction. For the analysis to be fully accurate, it must be performed on the binary code, which makes the well-known issue of state explosion even more critical. In this paper, we introduce a novel exploration strategy for symbolic execution aiming to limit the number of explored paths. Our strategy is inspired from the A* algorithm and steered towards least explored parts of the program. We compare our approach, using the Binsec tool, to three other classical strategies: depth-first (DFS), breadth-first (BFS) and non-uniform random (NURS). Our experiments on real-size programs show that our approach is promising.

关键词： Symbolic execution Program analysis binary code analysis A* algorithm

来源：评论

学校读者我要写书评

暂无评论

Scalable Program Clone Search through Spectral analysis 2023

Scalable Program Clone Search through Spectral Analysis

引用

31st ACM Joint Meeting of the European Software Engineering Conference / Symposium on the Foundations-of-Software-Engineering (ESEC/FSE)

作者： Benoit, Tristan Marion, Jean-Yves Bardin, Sebastien Univ Lorraine CNRS LORIA Nancy France Univ Paris Saclay CEA LIST Saclay France

ISBN: (纸本)9798400703270

We consider the problem of program clone search, i.e. given a target program and a repository of known programs (all in executable format), the goal is to find the program in the repository most similar to the target program - with potential applications in terms of reverse engineering, program clustering, malware lineage and software theft detection. Recent years have witnessed a blooming in code similarity techniques, yet most of them focus on function-level similarity and function clone search, while we are interested in program-level similarity and program clone search. Actually, our study shows that prior similarity approaches are either too slow to handle large program repositories, or not precise enough, or yet not robust against slight variations introduced by compilers, source code versions or light obfuscations. We propose a novel spectral analysis method for program-level similarity and program clone search called Programs Spectral Similarity (PSS). In a nutshell, PSS one-time spectral feature extraction is tailored for large repositories, making it a perfect fit for program clone search. We have compared the different approaches with extensive benchmarks, showing that PSS reaches a sweet spot in terms of precision, speed and robustness.

关键词： binary code analysis clone search spectral analysis

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：