TypeMiner: Recovering Types in Binary Programs Using Machine Learning

Maier, Alwin; Gascón, Hugo; Wressnegger, Christian; Rieck, Konrad

doi:10.1007/978-3-030-22038-9_14

Cited by 20 publications

(10 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…93% of all data objects are correctly classified as pointer or arithmetic types by TypeMiner [27]. This work is roughly similar to our D-type recognition.…”

Section: E String Recognitionsupporting

confidence: 78%

“…We pay more attention to types represented by pointers and strings, while related research has different goals for type recognition. Only TypeMiner [27] has similarities with our research, but not identical.…”

Section: Introductionsupporting

confidence: 47%

“…Then, we conduct a comparison against the string recognition plugin of IDA in terms of the accuracy. Finally, we verify the universality of our method on different operating systems and architectures by comparing with Typeminer [27]. We use 8 binary programs which are compiled from popular open source projects.…”

Section: Discussionmentioning

confidence: 99%

“…We collected 8 of the 14 open source codes mentioned in the literature [27] (the remaining 6 codes were not found or had compilation problems), and compiled them into programs in ×86-64 (little endian), and operation system adopted Ubuntu18.04. Then we chose.rodata segment as test dataset, as shown in Table 5.…”

Section: ) Test Dataset IIImentioning

confidence: 99%

See 3 more Smart Citations

Recognizing the Data Type of Firmware Data Segments With Deep Learning

Xiao¹,

Zhu²,

Lu³

et al. 2020

IEEE Access

View full text Add to dashboard Cite

Data segment analysis is of great value for firmware analysis. The data segment contains abundant information such as pointers and strings which is helpful for accelerating the process of code segment analysis. In this paper, we propose a novel approach of applying deep learning to solve the problem of data type identification in data segments, that is a fundamental problem in data segment analysis. We define 3 data types of data segment, then design several data segment byte feature extraction methods to construct feature sequences, and finally present a deep learning-based approach with feature sequences as input to recognize the data type byte by byte. Then, the recognized type can be further corrected efficiently by prior knowledge. Based on the data segment of a firmware, we built a dataset that included 18,032,352 samples (in bytes of data segment). We implement a prototype system and evaluate it with our dataset, then determine reasonable models and hyperparameters through several experiments, and eventually confirm that deep learning techniques are suitable for identifying the data type in data segment. Kappa coefficient of our data type recognition reached 0.96 and the models can be retained quickly. Using 131,072 samples in our dataset for 32 seconds of training, the accuracy can reach 90%; the accuracy can reach 97% with 273 seconds of training and 950,272 samples. Furthermore, our approach has higher accuracy than IDA in string recognition. In experiments, the recall and precision of our approach reached 96.5% and 90% respectively, whereas corresponding results of IDA is 92.9% and 85.7%. In addition, we selected 8 open source software to compile and test, and compared the detection results with TypeMiner. Experiments show that our method has certain cross-platform and operating system capabilities, and performs better than TypeMiner on some software.INDEX TERMS Reverse engineering, binary analysis, data segment, data type recognition, deep learning.

show abstract

“…93% of all data objects are correctly classified as pointer or arithmetic types by TypeMiner [27]. This work is roughly similar to our D-type recognition.…”

Section: E String Recognitionsupporting

confidence: 78%

Section: Introductionsupporting

confidence: 47%

Section: Discussionmentioning

confidence: 99%

Section: ) Test Dataset IIImentioning

confidence: 99%

See 2 more Smart Citations

Recognizing the Data Type of Firmware Data Segments With Deep Learning

Xiao¹,

Zhu²,

Lu³

et al. 2020

IEEE Access

View full text Add to dashboard Cite

show abstract

“…The exploration is improved if the type information is available. Therefore, the proposed method may more precisely explore by applying research of reverse-engineering type information such as TIE [19] or those of type prediction such as Debin [12] and TypeMiner [21]. Section 3.5, tap point detection uses matching between the values in a test script and thouse in script engines.…”

Section: Tap Point Detectionmentioning

confidence: 99%

My script engines know what you did in the dark

Toshinori

Otsuki²,

Kawakoya³

et al. 2019

Proceedings of the 35th Annual Computer Security Applications Conference

View full text Add to dashboard Cite

Malicious scripts have been crucial attack vectors in recent attacks such as malware spam (malspam) and fileless malware. Since malicious scripts are generally obfuscated, statically analyzing them is difficult due to reflections. Therefore, dynamic analysis, which is not affected by obfuscation, is used for malicious script analysis. However, despite its wide adoption, some problems remain unsolved. Current designs of script analysis tools do not fulfill the following three requirements important for malicious script analysis. (1) Universally applicable to various script languages, (2) capable of outputting analysis logs that can precisely recover the behavior of malicious scripts, and (3) applicable to proprietary script engines. In this paper, we propose a method for automatically generating script API tracer by analyzing the target script engine binaries. The method mine the knowledge of script engine internals that are required to append behavior analysis capability. This enables the addition of analysis functionalities to arbitrary script engines and generation of script API tracers that can fulfill the above requirements. Experimental results showed that we can apply this method for building malicious script analysis tools. CCS CONCEPTS • Security and privacy → Malware and its mitigation; Software reverse engineering; • Software and its engineering → Simulator / interpreter; • Computing methodologies → Optimization algorithms.

show abstract