Scalable Graph-based Bug Search for Firmware Images

Qian, Feng; Zhou, Rundong; Xu, Chaoshui; Cheng, Yuting; Testa, Brian; Yin, Heng

doi:10.1145/2976749.2978370

Cited by 318 publications

(349 citation statements)

References 35 publications

Supporting

Mentioning

323

Contrasting

Order By: Relevance

“…Machine learning based approaches. Machine learning, including deep learning, has been applied to code analysis [10], [38], [21], [62], [50], [43], [51], [29], [59], [28], [52], [27], [17]. Lee et al propose Instruction2vec for converting assembly instructions to vector representations [38]; but their instruction embedding model can only work on a single architecture.…”

Section: Related Workmentioning

confidence: 99%

“…A few works target cross-architecture binary code analysis [21], [62], [8], [67]. Some exploit the statistical aspects of code, rather than its semantics.…”

Section: Related Workmentioning

confidence: 99%

“…Some exploit the statistical aspects of code, rather than its semantics. For example, Genius [21] and Gemini [62] use some manually selected statistical features (e.g., the number of constants) to represent basic blocks, but they ignore the meaning of instructions and the dependency between them, resulting in significant loss of semantic information. INNEREYE-BB [67] uses LSTM to encode each basic block into an embedding, but it needs to train a separate instruction embedding model for each architecture.…”

Section: Related Workmentioning

confidence: 99%

“…Moreover, we plan to apply our model to other important code analysis tasks, such as cross-architecture bug search, and compare our model to recent approaches [21], [62], [67], [14].…”

Section: Future Workmentioning

confidence: 99%

“…Our solution achieves AUC = 0.90. Recent work [19], [21], [62] uses several manually selected statistic features (such as the number of instructions and the number of constants) of a basic block to represent it. However, a SVM classifier based on such features only achieves AUC = 0.85 for the same task.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

Redmond¹,

Luo²,

Zeng³

2019

Proceedings 2019 Workshop on Binary Analysis Research

View full text Add to dashboard Cite

Given a closed-source program, such as most of proprietary software and viruses, binary code analysis is indispensable for many tasks, such as code plagiarism detection and malware analysis. Today, source code is very often compiled for various architectures, making cross-architecture binary code analysis increasingly important. A binary, after being disassembled, is expressed in an assembly languages. Thus, recent work starts exploring Natural Language Processing (NLP) inspired binary code analysis. In NLP, words are usually represented in high-dimensional vectors (i.e., embeddings) to facilitate further processing, which is one of the most common and critical steps in many NLP tasks. We regard instructions as words in NLPinspired binary code analysis, and aim to represent instructions as embeddings as well.To facilitate cross-architecture binary code analysis, our goal is that similar instructions, regardless of their architectures, have embeddings close to each other. To this end, we propose a joint learning approach to generating instruction embeddings that capture not only the semantics of instructions within an architecture, but also their semantic relationships across architectures. To the best of our knowledge, this is the first work on building crossarchitecture instruction embedding model. As a showcase, we apply the model to resolving one of the most fundamental problems for binary code similarity comparison-semantics-based basic block comparison, and the solution outperforms the code statistics based approach. It demonstrates that it is promising to apply the model to other cross-architecture binary code analysis tasks.

show abstract

Section: Related Workmentioning

confidence: 99%

“…A few works target cross-architecture binary code analysis [21], [62], [8], [67]. Some exploit the statistical aspects of code, rather than its semantics.…”

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

“…Moreover, we plan to apply our model to other important code analysis tasks, such as cross-architecture bug search, and compare our model to recent approaches [21], [62], [67], [14].…”

Section: Future Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

Redmond¹,

Luo²,

Zeng³

2019

Proceedings 2019 Workshop on Binary Analysis Research

View full text Add to dashboard Cite

show abstract

Multigranularity semantics based vulnerability search method for cross‐platform binary

Líu

Zhang

2021

Int J of Intelligent Sys

View full text Add to dashboard Cite

Semantic learning is a common method for binary vulnerability detection, which can analyze the assembly structure of the binary code. The existing methods such as control flow graphs and labeled semantic flow graphs perform single semantic analysis to determine whether a known vulnerability is hidden in the binary function. However, challenge arises when they perform vulnerability detection cross‐platforms. In this paper, we propose a multigranularity semantic‐based vulnerability search method to deal with the challenge of cross‐platform vulnerability detection, and implement its prototype Taurus. Given the binary function to be searched and vulnerability function, Taurus first extracts their inter‐basic‐block, inter‐function, and inter‐module semantic features respectively, and then calculates the similarity distance between them at three levels. Finally, three similarity scores are combined to rank in descending order to obtain the vulnerability detection report. The performance comparison indicates that Taurus outperforms the state‐of‐the‐art approaches in terms of accuracy.

show abstract

Focus : Function clone identification on cross‐platform

Liu

et al. 2021

Int J of Intelligent Sys

View full text Add to dashboard Cite

Automatic identification of function clones on crossplatform aims at determining whether two functions are identical or not without access to the source code, which is a fundamental challenge in vulnerability search, code plagiarism detection, and malware classification. With the rapid development of deep neural network in pro-K E Y W O R D S attention mechanism, binary similarity, graph neural network, program analysis | INTRODUCTIONBinary code similarity detection is a key foundation in maintaining software security, which can be generally applied in searching critical vulnerability 1 and detecting malware, 2 and so forth. Today, with the booming development of billions of Internet of Things (IoT) devices, the similarity analysis of binary code has become even more important than ever, because (1) code reuse is quite common in IoT which spreads a single vulnerability at source code level across thousands or more embedded devices that have diverse hardware architectures and software platforms 3 and (2) a known vulnerability that has been exploited in the past can also cause unprecedented damage and significant revenue losses to our daily life. 4 Worryingly, accurate and efficient analysis of stripped binary code is difficult because debug information such as symbol names, types, and location of commercial off-the-shelf (COTS) binary is unavailable. Besides, compared to binary code similarity detection on single-platform, function identification on cross-platform needs to deal with the binary code differences caused by various architectures, optimization levels, and compilers, which is even more challenging.Traditional binary code similarity detection approaches 5 adopt symbolic execution, constraint solving, or theorem prover to directly check binary code equivalence. However, these methods are inefficient especially when the number of function pairs is large, making them difficult to be utilized in large-scale applications. Graph matching-based methods use program flow diagrams to represent functions and detect similar functions. [6][7][8][9][10][11] These methods are usually inaccurate or their detection performance is limited by the efficiency of graph matching algorithms. 1,12 For instance, Genius 10 takes more than 1 week to construct their proposed codebook for only three software packages and the time complexity is quadratic in the number of training samples and linear in the cost of the bipartite graph matching algorithm.Recently, with the rapid development of deep learning and graph neural network (GNN), 13,14 graph matching and classification problems such as social network graph analytics 15 and chemical formula matching 13 can be solved well by transforming a representative graph to an embedding.

show abstract

Scalable Graph-based Bug Search for Firmware Images

Cited by 318 publications

References 35 publications

A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

Multigranularity semantics based vulnerability search method for cross‐platform binary

Focus : Function clone identification on cross‐platform

Contact Info

Product

Resources

About