Software patch comparison technology through semantic analysis on function

Yan CAO; Long LIU; Yu WANG; Qingxian WANG

doi:10.11959/j.issn.2096-109x.2019051

您当前的位置：

首页 >

文章列表页 >

Software patch comparison technology through semantic analysis on function

Papers | 更新时间：2024-06-03

- Software patch comparison technology through semantic analysis on function
- Chinese Journal of Network and Information Security Vol. 5, Issue 5, Pages: 56-63(2019)
- 作者机构：
  
  1. 数学工程与先进计算国家重点实验室，河南郑州 450000
  2. 河南工程学院，河南郑州 450000
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2019051
  CLC： TP393
- Online First：2019-10，
  
  Published：15 October 2019
- 稿件说明：
移动端阅览
Yan CAO, Long LIU, Yu WANG, et al. Software patch comparison technology through semantic analysis on function[J]. Chinese Journal of Network and Information Security, 2019, 5(5): 56-63.
DOI：

Yan CAO, Long LIU, Yu WANG, et al. Software patch comparison technology through semantic analysis on function[J]. Chinese Journal of Network and Information Security, 2019, 5(5): 56-63. DOI： 10.11959/j.issn.2096-109x.2019051.

摘要

基于结构化的补丁比对是软件漏洞辅助分析的重要方法。在分析总结已有补丁比对技术及反补丁比对技术的基础上，针对结构化比对存在无法进行语义分析而导致误报的问题，提出了基于函数语义分析的软件补丁比对方法。利用传统的结构化比对方法，在函数级进行语法差异比较得到最大同构子图；通过程序依赖分析，构建函数输入输出之间的路径包络，基于符号执行以包络为对象计算函数输出特征；通过函数摘要进行语义级比对，结合最大同构子图的匹配函数结果，进一步分析得出发生语义变化的函数。最终，通过实验比对测试，验证了所提方法的可行性和优势。

Abstract

Patch comparison provides support for software vulnerability

and structural comparison has been developed.Based on summarizing binary files comparison and anti-comparison methods

comparison technology was proposed by semantic analysis on function to address the issue that structural comparison cannot carry on semantic analysis.Through traditional structural comparison

syntax differences in function-level were analyzed to find the maximum common subgraph.Then

the path cluster was built between the input and output of the function depend on program dependency analysis.Function output characteristics was established based on symbolic execution.Semantic differences of functions were compared by functional summaries.Based on the maximum isomorphic subgraph

the matched functions which there are possible semantic changes between was further analyzed.Ultimately

the experimental results showed the feasibility and advantages of the proposed method.

关键词

Keywords

references

WANG Z , PIERCE K , MCFARLING S . BMAT-a binary matching tool for stale profile propagation [J ] . The Journal of Instruction-Level Parallelism (JILP) , 2000 , 2 : 1 - 20 .

FLAKE H , . Structural comparison of executable objects [C ] // Dortmund GI SIG SIDAR Workshop , 2004 .

潘璠 , 吴礼发 , 孙传鲁 , 等 . 一种改进的补丁比较模型的研究与实现 [J ] . 南京邮电大学学报（自然科学版） , 2012 , 32 ( 2 ): 75 - 83 .

PAN F , WU L F , SUN C L , et al . Research and implementation of an improved patch comparison technique [J ] . Journal of Nanjing University of Posts and Telecommunications(Natural Science) , 2012 , 32 ( 2 ): 75 - 83 .

肖雅娟 . 二进制代码函数相似度匹配技术研究 [D ] . 济南:山东大学 , 2016 .

XIAO Y J . Research on similarity matching technology of binary code function [M ] . Jinan:Shandong University . 2016 .

LIU B C , BINGCHANG L , WEI H , CHAO Z , et al . α Diff:cross-version binary code similarity detection with DNN [C ] // IEEE ACM Automated Software Engineering (ASE’18) . 2018 .

XU X J , LIU C , FENG Q , et al . Neural network-based graph embedding for cross-platform binary code similarity detection [C ] // The 2017 ACM SIGSAC Conference on Computer and Communications Security . 2017 .

王欣 , 郭涛 , 董国伟 , 等 . 基于补丁比对的Concolic测试方法 [J ] . 清华大学学报（自然科学版） , 2013 , 53 ( 12 ): 1737 - 1742 .

WANG X , GUO T , DONG G W , et al . Concolic test method based on patch matching [J ] . Journal of Tsinghua University(Science and Technology) , 2013 , 53 ( 12 ): 1737 - 1742 .

王嘉捷 , 郭涛 , 张普含 , 等 . 基于软件代码差异分析的智能模糊测试 [J ] . 清华大学学报（自然科学版） , 2013 , 53 ( 12 ): 1726 - 1730 .

WANG J J , GUO T , ZHANG P H , et al . Intelligent fuzzy test based on software code difference analysis [J ] . Journal of Tsinghua University(Science and Technology) , 2013 , 53 ( 12 ): 1726 - 1730 .

SHAHZAD M , SHAFIQ M Z , LIU A.X . A large scale exploratory analysis of software vulnerability life cycles [C ] // International Conference on Software Engineering . 2012 : 771 - 781 .

FREI S , MAY M , FIEDLER U , et al . Large-scale vulnerability analysis [C ] // SIGCOMM Workshop on Large-Scale Attack Defense . 2006 : 131 - 138 .

BRUMLEY D , POOSANKAM P , SONG D , et al . Automatic patch-based exploit generation is possible:techniques and implication [C ] // Security ＆ Privac . 2008 .

AVERY J , SPAFFORD E H . Ghost patches:fake patches for fake vulnerabilities [C ] // International Conference on ICT Systems Security and Privacy Protection . 2017 : 399 - 412 .

JEONG W O , CHEN S . Binary and anti-binary comparison [C ] // XCon Information Security Conference . 2013 : 1 - 27 .

DEBIN G , MICHAEL K R , DAWN S . BinHunt:automatically finding semantic differences in binary programs [C ] // The 10th International Conference on Information and Communications Security . 2008 .

LANNAN L , JIANG M , DINGHAO W , et al . Semantics-based obfuscation-resilient binary code similarity comparison with applications to software plagiarism detection [J ] . IEEE Transactions on Software Engineering , 2017 , 43 ( 12 ): 1157 - 1177 .

ZHENG Z X , BIHUAN C , MAHINTHAN C , LIU Y , et al . SPAIN:security patch analysis for binaries towards understanding the pain and pills [C ] // The 39th International Conference on Software Engineering . 2017 .

CAO Y , WEI Q , WANG Q X . Research on parallel symbolic execution through program dependence analysis [C ] // The Fifth International Symposium on Computational Intelligence and Design . 2012 : 222 - 226 .

Views

768

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Metrics for code obfuscation based on symbolic execution and N-scope complexity

Security protocol code analysis method combining model learning and symbolic execution

Research on construction of conditional exception code used in branch obfuscation

Symbolic execution based control flow graph extraction method for Android native codes

Firmware vulnerability analysis based on formal verification of software and hardware

Related Author

Yawen WANG

Yunfei GUO

Yuqiang XIAO

Xi CHEN

Chunxiang GU

Yuefei ZHU

Xieli ZHANG

Yuefei ZHU

Related Institution

State Key Laboratory of Mathematical Engineering and Advanced Computing

Henan Key Laboratory of Network Cryptography Technology

School of Computer Science and Engineering, Changshu Institute of Technology, Changshu

School of Computer Science and Technology, Soochow University

College of Engineering, Huaqiao University

⁰