基于候选函数组的固件间函数对应关系构建方法

肖睿卿; 祝跃飞; 刘胜利; 芦斌

doi:10.11959/j.issn.2096-109x.2021018

您当前的位置：

首页 >

文章列表页 >

基于候选函数组的固件间函数对应关系构建方法

学术论文 | 更新时间：2024-06-03

- 基于候选函数组的固件间函数对应关系构建方法
- Method for constructing function correspondence between firmware based on candidate function group
- 网络与信息安全学报 2021年7卷第2期页码：110-125
- 作者机构：
- 作者简介：
  
  [ "肖睿卿（1992- ），男，黑龙江牡丹江人，数学工程与先进计算国家重点实验室博士生，主要研究方向为二进制分析。" ]
  [ "祝跃飞（1962- ），男，浙江兰溪人，数学工程与先进计算国家重点实验室教授、博士生导师，主要研究方向为安全协议和密码学。" ]
  [ "刘胜利（1973- ），男，河南周口人，数学工程与先进计算国家重点实验室教授、博士生导师，主要研究方向为网络设备安全和网络攻击检测。" ]
  [ "芦斌（1982-），男，山西灵石人，数学工程与先进计算国家重点实验室副教授，主要研究方向为信息安全、机器学习。" ]
- 基金信息：
  
  科技委基础加强项目;Science ＆ Technology Commission Foundation Strengthening Project(2019-JCJQ-ZD-113);国家重点研发计划;The National Key R＆D Program of China(2019QY1300);国家重点研发计划基金资助项目;The National Key R＆D Plan Program of China(2016YFB0801505)
- DOI：10.11959/j.issn.2096-109x.2021018
  中图分类号： TP393
- 网络首发：2021-04，
  
  纸质出版：2021-04-15
- 稿件说明：
移动端阅览
肖睿卿, 祝跃飞, 刘胜利, 等. 基于候选函数组的固件间函数对应关系构建方法[J]. 网络与信息安全学报, 2021,7(2):110-125.

Ruiqing XIAO, Yuefei ZHU, Shengli LIU, et al. Method for constructing function correspondence between firmware based on candidate function group[J]. Chinese Journal of Network and Information Security, 2021, 7(2): 110-125.
肖睿卿, 祝跃飞, 刘胜利, 等. 基于候选函数组的固件间函数对应关系构建方法[J]. 网络与信息安全学报, 2021,7(2):110-125. DOI： 10.11959/j.issn.2096-109x.2021018.

Ruiqing XIAO, Yuefei ZHU, Shengli LIU, et al. Method for constructing function correspondence between firmware based on candidate function group[J]. Chinese Journal of Network and Information Security, 2021, 7(2): 110-125. DOI： 10.11959/j.issn.2096-109x.2021018.

摘要

由于固件的特点，传统二进制比对方法在匹配函数节点传播匹配的过程中易产生误匹配。针对匹配函数传播效果不理想的问题，设计了基于候选函数组的函数对应关系构建方法，并引入了函数n层局部网络匹配的概念。然后，结合3种候选函数组构造策略形成候选函数组构造方法及候选函数组匹配方法，并分析了时间开销。最后，基于所提方法实现了原型系统，并与 Bindiff 进行比较。通过随机抽样和人工核对，所提方法匹配结果的86.04%与Bindiff匹配结果一致，所提方法匹配结果的11.3%可以修正Bindiff的匹配错误，缓解了传播带来的误匹配问题。

Abstract

Due to the characteristics of firmware

traditional binary comparison methods are prone to mismatches during the propagation of the matching function.Aiming at the problem that the matching function propagation algorithm is not ideal

a method for constructing function correspondence based on candidate function groups was designed

and the concept of function matching in n layer local network is supplemented.Then

three candidate function group construction strategies and candidate function group matching methods are proposed

and the time overhead were analyzed.Finally

a prototype system was implemented based on the method and compared with Bindiff.Through random sampling and manual check

86.04% of the matching results of the proposed method are consistent with Bindiff matching results

while 11.3% can correct Bindiff matching errors.

关键词

Keywords

references

A survey of binary code similarity [R ] . 2019 .

GAO J , YANG X , FU Y , et al . VulSeeker:a semantic learning based vulnerability seeker for cross-platform binary [C ] // Conference on Automated Software Engineering(ASE 2018) . 2018 .

FENG Q , ZHOU R , XU C , et al . Scalable graph-based bug search for firmware images [C ] // Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security . 2016 : 480 - 491 .

XU X , LIU C , FENG Q , et al . Neural network-based graph embedding for cross-platform binary code similarity detection [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . 2017 : 363 - 376 .

HU Y , ZHANG Y , LI J , et al . Cross-architecture binary semantics understanding via similar code comparison [C ] // 2016 IEEE 23rd International Conference on Software Analysis,Evolution,and Reengineering (SANER) . 2016 : 57 - 67 .

刘春红 , 郭涛 , 崔宝江 , 等 . 二进制文件同源性检测的结构化相似度计算 [J ] . 北京邮电大学学报 , 2012 , 35 ( 3 ): 56 - 60 .

LIU C H , GUO T , CUI B J , et al . Similarity computation for executable objects homology detection based on structural signature [J ] . Journal of Beijing University of Posts and Telecommunications , 2012 , 35 ( 3 ): 56 - 60 .

CESARE S , XIANG Y . Classification of malware using structured control flow [C ] // Proceedings of the Eighth Australasian Symposium on Parallel and Distributed Computing-Volume 107 . 2010 : 61 - 70 .

PEWNY J , GARMANY B , GAWLIK R , et al . Cross-architecture bug search in binary executables [C ] // 2015 IEEE Symposium on Security and Privacy . 2015 : 709 - 724 .

ESCHWEILER S , YAKDAN K GERHARDS-PADILLA E . DiscovRE:efficient cross-architecture identification of bugs in binary code [C ] // NDSS . 2016 .

Flake H , . Structural comparison of executable objects [C ] // Proc of the International GI Workshop on Detection of Intrusions and Malware ＆ Vulnerability Assessment . 2004 : 161 - 174 .

DULLIEN T , ROLLES R . Graph-based comparison of executable objects [J ] . SSTIC , 2005 , 5 ( 1 ): 3 .

王建新 , 杨凡 , 韩锋 . 二进制文件比对中的指令归并优化算法 [J ] . 计算机应用与软件 , 2013 , 30 ( 12 ): 40 - 42 + 126 .

WANG J X , YANG F , HAN F . Instruction merging optimization algorithm in binary files comparison [J ] . Computer Applications and Software , 2013 , 30 ( 12 ): 40 - 42 + 126 .

KHOO W M , MYCROFT A , ANDERSON R . Rendezvous:a search engine for binary code [C ] // Proceedings of the 10th Working Conference on Mining Software Repositories . 2013 : 329 - 338 .

BOURQUIN M , KING A , ROBBINS E . Binslayer:accurate comparison of binary executables [C ] // Proceedings of the 2nd ACM SIGPLAN Program Protection and Reverse Engineering Workshop . 2013 :4.

HU X , CHIUEH T , SHIN K G . Large-scale malware indexing using function-call graphs [C ] // Proceedings of the 16th ACM Conference on Computer and Communications Security . 2009 : 611 - 620 .

刘星 , 唐勇 . 恶意代码的函数调用图相似性分析 [J ] . 计算机工程与科学 , 2014 , 36 ( 3 ): 481 - 486 .

LIU X , TANG Y . Similarity analysis of malware's function-call graphs [J ] . Computer Engineering ＆ Science , 2014 , 36 ( 3 ): 481 - 486 .

KOSTAKIS O , KINABLE J , MAHMOUDI H , et al . Improved call graph comparison using simulated annealing [C ] // Proceedings of the 2011 ACM Symposium on Applied Computing . 2011 : 1516 - 1523 .

孙贺 , 吴礼发 , 洪征 , 等 . 基于函数调用图的二进制程序相似性分析 [J ] . 计算机工程与应用 , 2016 , 52 ( 21 ): 126 - 133 .

SUN H , WU L F , HONG Z , et al . Research on function call graph based method for similarity analysis of binary files [J ] . Computer Engineering and Applications , 2016 , 52 ( 21 ): 126 - 133 .

JANG J , AGRAWAL A , BRUMLEY D . ReDeBug:finding unpatched code clones in entire OS distributions [C ] // 2012 IEEE Symposium on Security and Privacy . 2012 : 48 - 62 .

DAVID Y , YAHAV E . Tracelet-based code search in executables [J ] . ACM Sigplan Notices , 2014 , 49 ( 6 ): 349 - 360 .

PEWNY J , SCHUSTER F , BERNHARD L , et al . Leveraging semantic signatures for bug search in binary programs [C ] // Proceedings of the 30th Annual Computer Security Applications Conference . 2014 : 406 - 415 .

Cisco 2600 Series Multiservice Platforms - Retirement Notification [EB ] .

Bindiff5 [EB ] . 2019 .

COSTIN A , ZADDACH J , FRANCILLON A , et al . A large-scale analysis of the security of embedded firmwares [C ] // 23rd {USENIX}Security Symposium ({USENIX} Security 14) . 2014 : 95 - 110 .

肖睿卿 , 刘胜利 , 颜猛 , 等 . 节点层次化的二进制文件比对技术 [J ] . 计算机工程与应用 , 2017 , 53 ( 21 ): 144 - 150 .

XIAO R Q , LIU S L , YAN M , et al . Comparison technology of binary files based on hierarchical nodes [J ] . Computer Engineering and Applications , 2017 , 53 ( 21 ): 144 - 150 .

浏览量

191

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据