Method for constructing function correspondence between firmware based on candidate function group

Ruiqing XIAO; Yuefei ZHU; Shengli LIU; Bin LU

doi:10.11959/j.issn.2096-109x.2021018

您当前的位置：

首页 >

文章列表页 >

Method for constructing function correspondence between firmware based on candidate function group

Papers | 更新时间：2024-06-03

- Method for constructing function correspondence between firmware based on candidate function group
- Chinese Journal of Network and Information Security Vol. 7, Issue 2, Pages: 110-125(2021)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021018
  CLC： TP393
- Online First：2021-04，
  
  Published：15 April 2021
- 稿件说明：
移动端阅览
Ruiqing XIAO, Yuefei ZHU, Shengli LIU, et al. Method for constructing function correspondence between firmware based on candidate function group[J]. Chinese Journal of Network and Information Security, 2021, 7(2): 110-125.
DOI：

Ruiqing XIAO, Yuefei ZHU, Shengli LIU, et al. Method for constructing function correspondence between firmware based on candidate function group[J]. Chinese Journal of Network and Information Security, 2021, 7(2): 110-125. DOI： 10.11959/j.issn.2096-109x.2021018.

摘要

由于固件的特点，传统二进制比对方法在匹配函数节点传播匹配的过程中易产生误匹配。针对匹配函数传播效果不理想的问题，设计了基于候选函数组的函数对应关系构建方法，并引入了函数n层局部网络匹配的概念。然后，结合3种候选函数组构造策略形成候选函数组构造方法及候选函数组匹配方法，并分析了时间开销。最后，基于所提方法实现了原型系统，并与 Bindiff 进行比较。通过随机抽样和人工核对，所提方法匹配结果的86.04%与Bindiff匹配结果一致，所提方法匹配结果的11.3%可以修正Bindiff的匹配错误，缓解了传播带来的误匹配问题。

Abstract

Due to the characteristics of firmware

traditional binary comparison methods are prone to mismatches during the propagation of the matching function.Aiming at the problem that the matching function propagation algorithm is not ideal

a method for constructing function correspondence based on candidate function groups was designed

and the concept of function matching in n layer local network is supplemented.Then

three candidate function group construction strategies and candidate function group matching methods are proposed

and the time overhead were analyzed.Finally

a prototype system was implemented based on the method and compared with Bindiff.Through random sampling and manual check

86.04% of the matching results of the proposed method are consistent with Bindiff matching results

while 11.3% can correct Bindiff matching errors.

关键词

Keywords

references

A survey of binary code similarity [R ] . 2019 .

GAO J , YANG X , FU Y , et al . VulSeeker:a semantic learning based vulnerability seeker for cross-platform binary [C ] // Conference on Automated Software Engineering(ASE 2018) . 2018 .

FENG Q , ZHOU R , XU C , et al . Scalable graph-based bug search for firmware images [C ] // Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security . 2016 : 480 - 491 .

XU X , LIU C , FENG Q , et al . Neural network-based graph embedding for cross-platform binary code similarity detection [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . 2017 : 363 - 376 .

HU Y , ZHANG Y , LI J , et al . Cross-architecture binary semantics understanding via similar code comparison [C ] // 2016 IEEE 23rd International Conference on Software Analysis,Evolution,and Reengineering (SANER) . 2016 : 57 - 67 .

刘春红 , 郭涛 , 崔宝江 , 等 . 二进制文件同源性检测的结构化相似度计算 [J ] . 北京邮电大学学报 , 2012 , 35 ( 3 ): 56 - 60 .

LIU C H , GUO T , CUI B J , et al . Similarity computation for executable objects homology detection based on structural signature [J ] . Journal of Beijing University of Posts and Telecommunications , 2012 , 35 ( 3 ): 56 - 60 .

CESARE S , XIANG Y . Classification of malware using structured control flow [C ] // Proceedings of the Eighth Australasian Symposium on Parallel and Distributed Computing-Volume 107 . 2010 : 61 - 70 .

PEWNY J , GARMANY B , GAWLIK R , et al . Cross-architecture bug search in binary executables [C ] // 2015 IEEE Symposium on Security and Privacy . 2015 : 709 - 724 .

ESCHWEILER S , YAKDAN K GERHARDS-PADILLA E . DiscovRE:efficient cross-architecture identification of bugs in binary code [C ] // NDSS . 2016 .

Flake H , . Structural comparison of executable objects [C ] // Proc of the International GI Workshop on Detection of Intrusions and Malware ＆ Vulnerability Assessment . 2004 : 161 - 174 .

DULLIEN T , ROLLES R . Graph-based comparison of executable objects [J ] . SSTIC , 2005 , 5 ( 1 ): 3 .

王建新 , 杨凡 , 韩锋 . 二进制文件比对中的指令归并优化算法 [J ] . 计算机应用与软件 , 2013 , 30 ( 12 ): 40 - 42 + 126 .

WANG J X , YANG F , HAN F . Instruction merging optimization algorithm in binary files comparison [J ] . Computer Applications and Software , 2013 , 30 ( 12 ): 40 - 42 + 126 .

KHOO W M , MYCROFT A , ANDERSON R . Rendezvous:a search engine for binary code [C ] // Proceedings of the 10th Working Conference on Mining Software Repositories . 2013 : 329 - 338 .

BOURQUIN M , KING A , ROBBINS E . Binslayer:accurate comparison of binary executables [C ] // Proceedings of the 2nd ACM SIGPLAN Program Protection and Reverse Engineering Workshop . 2013 :4.

HU X , CHIUEH T , SHIN K G . Large-scale malware indexing using function-call graphs [C ] // Proceedings of the 16th ACM Conference on Computer and Communications Security . 2009 : 611 - 620 .

刘星 , 唐勇 . 恶意代码的函数调用图相似性分析 [J ] . 计算机工程与科学 , 2014 , 36 ( 3 ): 481 - 486 .

LIU X , TANG Y . Similarity analysis of malware's function-call graphs [J ] . Computer Engineering ＆ Science , 2014 , 36 ( 3 ): 481 - 486 .

KOSTAKIS O , KINABLE J , MAHMOUDI H , et al . Improved call graph comparison using simulated annealing [C ] // Proceedings of the 2011 ACM Symposium on Applied Computing . 2011 : 1516 - 1523 .

孙贺 , 吴礼发 , 洪征 , 等 . 基于函数调用图的二进制程序相似性分析 [J ] . 计算机工程与应用 , 2016 , 52 ( 21 ): 126 - 133 .

SUN H , WU L F , HONG Z , et al . Research on function call graph based method for similarity analysis of binary files [J ] . Computer Engineering and Applications , 2016 , 52 ( 21 ): 126 - 133 .

JANG J , AGRAWAL A , BRUMLEY D . ReDeBug:finding unpatched code clones in entire OS distributions [C ] // 2012 IEEE Symposium on Security and Privacy . 2012 : 48 - 62 .

DAVID Y , YAHAV E . Tracelet-based code search in executables [J ] . ACM Sigplan Notices , 2014 , 49 ( 6 ): 349 - 360 .

PEWNY J , SCHUSTER F , BERNHARD L , et al . Leveraging semantic signatures for bug search in binary programs [C ] // Proceedings of the 30th Annual Computer Security Applications Conference . 2014 : 406 - 415 .

Cisco 2600 Series Multiservice Platforms - Retirement Notification [EB ] .

Bindiff5 [EB ] . 2019 .

COSTIN A , ZADDACH J , FRANCILLON A , et al . A large-scale analysis of the security of embedded firmwares [C ] // 23rd {USENIX}Security Symposium ({USENIX} Security 14) . 2014 : 95 - 110 .

肖睿卿 , 刘胜利 , 颜猛 , 等 . 节点层次化的二进制文件比对技术 [J ] . 计算机工程与应用 , 2017 , 53 ( 21 ): 144 - 150 .

XIAO R Q , LIU S L , YAN M , et al . Comparison technology of binary files based on hierarchical nodes [J ] . Computer Engineering and Applications , 2017 , 53 ( 21 ): 144 - 150 .

Views

191

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

⁰