Fine-Grained Obfuscation Scheme Recognition on Binary Code

Tian, Zhenzhou; Mao, Hengchao; Huang, Yaqian; Tian, Jie; Li, Jingrui

doi:10.1007/978-3-031-06365-7_13

Cited by 3 publications

(1 citation statement)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Just like many other binary analysis studies [4,10,41] focusing on individual functions, MulCPI operates under the assumption that the function under examination can always be accurately identified and extracted from the binary file. In our study, we leverage IDA Pro, the leading binary reverse engineering tool, to alleviate such issues of inaccurate function sample acquisition, considering its high performance and prevalence in binary analysis.…”

Section: Threats To Validitymentioning

confidence: 99%

Function-Level Compilation Provenance Identification with Multi-Faceted Neural Feature Distillation and Fusion

Gao,

Liang,

et al. 2024

Electronics

View full text Add to dashboard Cite

In the landscape of software development, the selection of compilation tools and settings plays a pivotal role in the creation of executable binaries. This diversity, while beneficial, introduces significant challenges for reverse engineers and security analysts in deciphering the compilation provenance of binary code. To this end, we present MulCPI, short for Multi-representation Fusion-based Compilation Provenance Identification, which integrates the features collected from multiple distinct intermediate representations of the binary code for better discernment of the fine-grained function-level compilation details. In particular, we devise a novel graph-oriented neural encoder improved upon the gated graph neural network by subtly introducing an attention mechanism into the neighborhood nodes’ information aggregation computation, in order to better distill the more informative features from the attributed control flow graph. By further integrating the features collected from the normalized assembly sequence with an advanced Transformer encoder, MulCPI is capable of capturing a more comprehensive set of features manifesting the multi-faceted lexical, syntactic, and structural insights of the binary code. Extensive evaluation on a public dataset comprising 854,858 unique functions demonstrates that MulCPI exceeds the performance of current leading methods in identifying the compiler family, optimization level, compiler version, and the combination of compilation settings. It achieves average accuracy rates of 99.3%, 96.4%, 90.7%, and 85.3% on these tasks, respectively. Additionally, an ablation study highlights the significance of MulCPI’s core designs, validating the efficiency of the proposed attention-enhanced gated graph neural network encoder and the advantages of incorporating multiple code representations.

show abstract

Section: Threats To Validitymentioning

confidence: 99%

Function-Level Compilation Provenance Identification with Multi-Faceted Neural Feature Distillation and Fusion

Gao,

Liang,

et al. 2024

Electronics

View full text Add to dashboard Cite

show abstract

Identification of binary file compilation information

Pan

Yan

et al. 2022

2022 IEEE 5th Advanced Information Management, Communicates, Electronic and Automation Control Conference (IMCEC)

View full text Add to dashboard Cite

Function-Level Code Obfuscation Detection Through Self-Attention-Guided Multi-Representation Fusion

Tian,

He,

Zhao

et al. 2023

Int. J. Soft. Eng. Knowl. Eng.

View full text Add to dashboard Cite

Malware developers often employ code obfuscation techniques to conceal their malicious functionality, making it challenging to detect and analyze such software. While various de-obfuscation techniques exist, the majority of them require prior knowledge of the obfuscation tools and techniques in use. Identifying the specific obfuscation tools or algorithms applied to the obfuscated code is thus of vital importance, which, however, typically demands in-depth expert knowledge and substantial efforts. Therefore, this paper presents DeObA, a deep learning (DL) driven approach for the precise and efficient detection of obfuscation algorithms on the fine-grained function-level code snippets. To comprehensively capture unique patterns or features of different obfuscation algorithms from code, DeObA works on multiple distinct code views, encompassing token sequences, abstract syntax trees (AST) and program dependency graphs (PDG), which will reflect the code’s lexical morphology, syntactic and structural aspects. After individually collecting obfuscation-indicative features with well-matched DL encoder from each code view, a self-attention-based fusion strategy is performed on these features to produce an integrated, dense, yet feature-rich vector. This vector is then fed into a softmax classification layer for prediction. Due to the lack of a moderately sized dataset, a large obfuscation corpus is curated with 7 different obfuscation tools and a total of 12 obfuscation algorithms on 39,070 C/C[Formula: see text] functions. The experimental evaluations conducted on the dataset exhibit a distinguished detection performance of DeObA, which achieve accuracy rates of 99.90% and 99.19% on the obfuscation tool detection and obfuscation algorithm detection tasks, respectively. The ablation study also confirms the active role of considering multiple distinct code views and the effectiveness of the designed self-attention-based fusion strategy.

show abstract

Fine-Grained Obfuscation Scheme Recognition on Binary Code

Cited by 3 publications

References 18 publications

Function-Level Compilation Provenance Identification with Multi-Faceted Neural Feature Distillation and Fusion

Function-Level Compilation Provenance Identification with Multi-Faceted Neural Feature Distillation and Fusion

Identification of binary file compilation information

Function-Level Code Obfuscation Detection Through Self-Attention-Guided Multi-Representation Fusion

Contact Info

Product

Resources

About