基于函数摘要的二进制程序污点分析优化方法

杨盼; 康绯; 舒辉; 黄宇垚; 吕小少

doi:10.11959/j.issn.2096-109x.2023026

您当前的位置：

首页 >

文章列表页 >

基于函数摘要的二进制程序污点分析优化方法

学术论文 | 更新时间：2024-06-03

- 基于函数摘要的二进制程序污点分析优化方法
- Binary program taint analysis optimization method based on function summary
- 网络与信息安全学报 2023年9卷第2期页码：115-131
- 作者机构：
- 作者简介：
  
  [ "杨盼（1993- ），男，陕西宝鸡人，数字工程与先进计算国家重点实验室硕士生，主要研究方向为软件逆向分析" ]
  [ "康绯（1972- ），女，河南周口人，数字工程与先进计算国家重点实验室教授，主要研究方向为网络信息安全" ]
  [ "舒辉（1974- ），男，江苏盐城人，数字工程与先进计算国家重点实验室教授、博士生导师，主要研究方向为网络安全" ]
  [ "黄宇垚（1997- ），男，福建福州人，数字工程与先进计算国家重点实验室硕士生，主要研究方向为网络协议安全" ]
  [ "吕小少（1989- ），男，湖北荆门人，数字工程与先进计算国家重点实验室硕士生，主要研究方向为软件逆向分析" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2019QY1300)
- DOI：10.11959/j.issn.2096-109x.2023026
  中图分类号： TP393
- 网络首发：2023-04，
  
  纸质出版：2023-04-25
- 稿件说明：
移动端阅览
杨盼, 康绯, 舒辉, 等. 基于函数摘要的二进制程序污点分析优化方法[J]. 网络与信息安全学报, 2023,9(2):115-131.

Pan YANG, Fei KANG, Hui SHU, et al. Binary program taint analysis optimization method based on function summary[J]. Chinese Journal of Network and Information Security, 2023, 9(2): 115-131.
杨盼, 康绯, 舒辉, 等. 基于函数摘要的二进制程序污点分析优化方法[J]. 网络与信息安全学报, 2023,9(2):115-131. DOI： 10.11959/j.issn.2096-109x.2023026.

Pan YANG, Fei KANG, Hui SHU, et al. Binary program taint analysis optimization method based on function summary[J]. Chinese Journal of Network and Information Security, 2023, 9(2): 115-131. DOI： 10.11959/j.issn.2096-109x.2023026.

摘要

污点分析是一种常用的软件分析方法，在信息安全领域有较多的应用。现有的二进制程序动态污点分析大多采用指令级插桩的分析方法，通常会产生巨大的性能开销，使得程序执行效率大幅度降低，难以在复杂恶意样本和商业软件分析环境中有效应用。为了提升污点分析效率，降低指令级插桩分析带来的性能损耗，使污点分析更加广泛地应用在软件分析中，提出了基于函数摘要的二进制程序污点分析优化方法。所提方法使用函数污点传播规则代替指令污点传播规则，以减少数据流传播分析次数，有效提升污点分析效率。对于函数摘要，提出了函数摘要的定义；研究了不同函数结构的摘要生成算法。在函数内部，针对非循环结构，设计了路径敏感的分析方法；针对循环结构，设计了有限迭代的分析方法，将这两种分析方法相结合，解决混合结构函数的函数摘要生成。在函数摘要生成算法研究的基础上，进一步设计实现了由函数摘要生成模块、数据流记录模块、污点分析模块3个部分构成的通用污点分析框架FSTaint。对FSTaint的分析效率进行了评估，在分析真实APT恶意样本中，FSTaint的污点分析效率是libdft的7.75倍，分析效率较高；在准确性方面，FSTaint相对libdft在传播规则的准确性、完备性等方面也有所提高。

Abstract

Taint analysis is a popular software analysis method

which has been widely used in the field of information security.Most of the existing binary program dynamic taint analysis frameworks use instruction-level instrumentation analysis methods

which usually generate huge performance overhead and reduce the program execution efficiency by several times or even dozens of times.This limits taint analysis technology’s wide usage in complex malicious samples and commercial software analysis.An optimization method of taint analysis based on function summary was proposed

to improve the efficiency of taint analysis

reduce the performance loss caused by instruction-level instrumentation analysis

and make taint analysis to be more widely used in software analysis.The taint analysis method based on function summary used function taint propagation rules instead of instruction taint propagation rules to reduce the number of data stream propagation analysis and effectively improve the efficiency of taint analysis.For function summary

the definition of function summary was proposed.And the summary generation algorithms of different function structures were studied.Inside the function

a path-sensitive analysis method was designed for acyclic structures.For cyclic structures

a finite iteration method was designed.Moreover

the two analysis methods were combined to solve the function summary generation of mixed structure functions.Based on this research

a general taint analysis framework called FSTaint was designed and implemented

consisting of a function summary generation module

a data flow recording module

and a taint analysis module.The efficiency of FSTaint was evaluated in the analysis of real APT malicious samples

where the taint analysis efficiency of FSTaint was found to be 7.75 times that of libdft

and the analysis efficiency was higher.In terms of accuracy

FSTaint has more accurate and complete propagation rules than libdft.

关键词

Keywords

references

SCHWARTZ E J , AVGERINOS T , BRUMLEY D . All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask) [C ] // Proceedings of 31st IEEE Symposium on Security and Privacy . 2010 : 16 - 19 .

郭方方 , 王欣悦 , 王慧强 , 等 . 基于最大频繁子图挖掘的动态污点分析方法 [J ] . 计算机研究与发展 , 2020 , 57 ( 3 ): 631 - 638 .

GUO F F , WANG X Y , WANG H Q , et al . A dynamic stain analysis method on maximal frequent sub graph mining [J ] . Journal of Computer Research and Development , 2020 , 57 ( 3 ): 631 - 638 .

KORCZYNSKI D , YIN H . Capturing malware propagations with code injections and code-reuse attacks [C ] // Proceedings of 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS ＇17) . 2017 : 691 - 1708 .

CABALLERO J , GRIECO G , MARRON M , et al . Undangle:early detection of dangling pointers in use-after-free and double-free vulnerabilities [C ] // Proceedings of the 2012 International Symposium on Software Testing and Analysis - ISSTA 2012 . 2012 : 133 - 143 .

CHEN P , CHEN H . Angora:efficient fuzzing by principled search [C ] // Proceedings of 2018 IEEE Symposium on Security and Privacy . 2018 : 711 - 725 .

DUMITRU C . Detecting software vulnerabilities static taint analysis [D ] . Bucharest :University Politehnica of Bucharest , 2009 .

高凤娟 , 王豫 , 陈天骄 , 等 . 基于污点分析的数组越界缺陷的静态检测方法 [J ] . 软件学报 , 2020 , 31 ( 10 ): 2983 - 3003 .

GAO F J , WANG Y , CHEN T J , et al . Static checking of array index out of bounds defects in C programs based on taint analysis [J ] . Journal of Software , 2020 , 31 ( 10 ): 2983 - 3003 .

JANG D , JHALA R , LERNER S , et al . An empirical study of privacy-violating information flows in JavaScript web applications [C ] // Proceedings of the 17th ACM Conference on Computer and Communications Security - CCS ＇10 . 2010 : 270 - 283 .

WANG X J , MA R , DOU B W , et al . OFFDTAN:a new approach of offline dynamic taint analysis for binaries [J ] . Security and Communication Networks,2018 , 2018 :7693861.

LUK C K , COHN R , MUTH R , et al . Pin:building customized program analysis tools with dynamic instrumentation [C ] // Proceedings of 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI ＇05) . 2005 : 190 - 200 .

BRUENING D , ZHAO Q , AMARASINGHE S . Transparent dynamic instrumentation [C ] // Proceedings of the 8th ACM SIGPLAN/SIGOPS Conference on Virtual Execution Environments VEE ＇12 . New York:ACM Press , 2012 : 133 - 144 .

CLAUSE J , LI W C , ORSO A . Dytan:a generic dynamic taint analysis framework [C ] // Proceedings of the 2007 International Symposium on Software Testing and Analysis - ISSTA ＇07 . 2007 : 196 - 206 .

KEMERLIS V P , PORTOKALIDIS G , JEE K , et al . Libdft [J ] . ACM SIGPLAN Notices , 2012 , 47 ( 7 ): 121 - 132 .

GALEA J , KROENING D . The taint rabbit:optimizing generic taint analysis with dynamic fast path generation [EB ] .

JIANG M , WU D H , XIAO G Y , et al . TaintPipe:pipelined symbolic taint analysis [C ] // Proceedings of 24th USENIX Conference on Security Symposium (SEC＇15) . 2015 : 65 - 80 .

CHABBI M . Efficient dynamic taint analysis using multicore machines [D ] . Arizona:The University of Arizona , 2015 .

代伟 , 刘智 , 刘益和 . 基于二进制代码的动态污点分析 [J ] . 计算机应用研究 , 2014 , 31 ( 8 ): 2497 - 2501 , 2505 .

DAI W , LIU Z , LIU Y H . Binary code-based dynamic taint analysis [J ] . Application Research of Computers , 2014 , 31 ( 8 ): 2497 - 2501 , 2505 .

YAN S , WANG R , SALLS C , et al . SOK:(State of) The Art of War:Offensive Techniques in Binary Analysis [C ] // Proceedings of IEEE Security ＆ Privacy . 2016 : 138 - 157 .

NGUYEN A Q , DANG H V . Unicorn:next generation CPU emulator framework [C ] // Proceedings of BlackHat USA . 2015 .

Capstone [EB ] .

dftwin [EB ] .

浏览量

356

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于混合分析的Java反序列化利用链挖掘方法

增强型虚拟寄存器轮转算法