A static repairing method of a malicious code obfuscation technology based on symbolic execution
By combining static analysis and symbolic execution techniques, a list of sensitive APIs is generated, and hook functions, replacement functions, pruning, and reconstruction of the graph features of Android malware are written. This solves the accuracy problem of static obfuscation adversarial methods and improves the accuracy of malware detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- UNIV OF ELECTRONICS SCI & TECH OF CHINA
- Filing Date
- 2023-05-06
- Publication Date
- 2026-05-19
AI Technical Summary
Existing static analysis tools lack the ability to defend against static obfuscation of Android malware, resulting in serious static escape problems of malware. Furthermore, symbolic execution tools cannot be fully adapted to the Android system, making it difficult to extract complete and effective graph feature information for repair.
By combining static analysis and symbolic execution techniques, a list of sensitive APIs is generated and hook functions are written. The Android application is simulated by symbolic execution, some functions are replaced, state information and basic block segmentation information are generated, the original graph features are pruned and reconstructed, static obfuscation information is eliminated, and effective graph features are mined.
It improves the accuracy of static detection of Android malware, fills the gap in the ability of existing tools to fix static obfuscation, and achieves high-accuracy malware identification.
Smart Images
Figure CN116662994B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer technology and provides a static repair method for malicious code obfuscation techniques based on symbolic execution. Background Technology
[0002] With the continuous development of internet technology, the Android operating system, due to its open-source nature and scalability, has gradually become one of the most widely used operating systems for mobile terminals and IoT devices in China and even the world. Surveys show that 85% of mobile phones worldwide use Android as their operating system. Beyond smartphones, Android OS and its branches such as Android TV, Android Auto, and Android Go have also become mainstream choices for smart home systems, in-vehicle systems, and underlying IoT device operating systems. This has led to a surge in Android malware, whose threat to the internet is rapidly increasing. Statistics show that from June 2016 to March 2020, the total number of newly added Android malware samples reached 482,576 per month. Meanwhile, the Canadian Cyber Security Institute concluded through its capture of Android malware that nearly 12,000 new instances of Android malware are created every day. Of all malware, Android-based malware accounts for as much as 46%, and this proportion is still growing.
[0003] In the detection and classification of Android malware, researchers typically employ two analysis methods: dynamic analysis and static analysis. Static analysis specifically refers to disassembling the application using decompilation techniques without running it, and extracting relevant static information from the disassembly results. With advancements in Android malware developer skills, increasingly more static obfuscation techniques are being used to hide static characteristics, posing a serious threat to mobile security. Simultaneously, researchers are continuously conducting related research, improving existing static analysis methods, and proposing new ones. Abstract graph features are currently the mainstream static analysis feature. To counter this detection method based on code logic features, attackers have begun using code logic obfuscation techniques. Code logic obfuscation primarily targets the logic or semantics of the code, altering static logical features such as the program's data flow graph and control flow graph, thereby increasing code complexity. Since most static analysis tools lack obfuscation defense capabilities, a range of static obfuscation techniques, including logic obfuscation, have severely impacted the accuracy of static analysis. Although symbolic execution technology has begun to be used to combat obfuscation techniques, most of the current mainstream symbolic execution tools are designed for Windows applications and lack support for simulating functions specific to the Android system. This results in existing symbolic execution tools not being fully compatible with the Android system, limiting their use in the field of Android anti-obfuscation. Researchers cannot use symbolic execution tools to simulate the correct execution flow of a program, and thus find it difficult to extract complete and effective graph feature information to repair fake graph features.
[0004] In summary, static obfuscation has received widespread attention from researchers in the static analysis of Android malware, and has to some extent compensated for the shortcomings of static analysis. However, previous research shows that static obfuscation techniques still have the following problems:
[0005] 1. Malware with obfuscated code logic is difficult to distinguish due to its static characteristics;
[0006] 2. Current mainstream static analysis tools lack static obfuscation defense capabilities, which can easily lead to static analysis tool failure and malware static escape when faced with obfuscated malicious applications;
[0007] 3. Existing symbolic execution tools are not fully compatible with the Android system and have limitations in the field of Android anti-obfuscation. Researchers cannot use symbolic execution tools to simulate the correct execution flow of the program, and therefore find it difficult to mine complete and effective graph feature information to repair the original graph features. Summary of the Invention
[0008] The purpose of this invention is to provide a static repair method for malicious code obfuscation techniques based on symbolic execution, thereby solving the problem of static escape of malicious software when faced with obfuscated malicious software by existing static analysis techniques.
[0009] To achieve the above objectives, the technical solution adopted by the present invention is as follows:
[0010] A static remediation method for malware obfuscation techniques based on symbolic execution, combining static analysis and symbolic execution, includes the following steps:
[0011] Step 1: Perform basic static analysis on the Android application under test to obtain a list of sensitive APIs and original graph features in the Android application under test;
[0012] Step 2: Based on the sensitive API list obtained in Step 1, write hook functions to simulate the functionality of the sensitive API list, generate a function replacement table, and use symbolic execution technology to simulate running the Android application. During this process, some functions are replaced according to the function replacement table, and finally, the overall execution status information and basic block segmentation information of the Android application during simulated execution are obtained. In Step 1, we obtained all the sensitive APIs existing in the tested Android application and summed them into a sensitive API list.
[0013] Step 3: Based on the state information and block information, prune and reconstruct the original graph features to achieve static repair, eliminate static obfuscation information, and mine the effective graph features.
[0014] In the above technical solution, the specific steps of step 1 are as follows:
[0015] Using IDA Pro and Androguard static analysis tools, static analysis was performed on the .dex binary file inside the tested Android APK to obtain the original static graph features and its internal function list, confirming the presence of traditional Android sensitive APIs defined by Google and new sensitive APIs discovered in previous research, and generating a list of sensitive APIs.
[0016] In the above technical solution, the specific steps of step 2 are as follows:
[0017] Based on the obtained list of sensitive APIs, some functions in the Android application are replaced. Symbolic execution techniques are then used to generate state information and basic block segmentation information. The specific steps are as follows:
[0018] Step A1: Obtain the binary object of the Android application in memory, confirm the starting address, instruction length, and register usage status of each sensitive API in the sensitive API list in Step 1, write corresponding hook functions based on the original sensitive API function code logic and register usage status, and store each sensitive API name, corresponding hook function name, sensitive API starting address, and instruction length as a function replacement table.
[0019] Step A2: Simulate the execution of the Android application using symbolic execution technology. Load the binary executable file in the Android APK into memory, convert all variables into symbolic variables, convert each instruction into a symbolic expression, solve the constraints according to the program instruction flow, modify the corresponding memory addresses and registers, and retain the state information of each stage and the corresponding basic block information. When the instruction that calls a sensitive API is executed, consult the function replacement table obtained in Step A1, and replace the function with the corresponding hook function starting at the starting address of the sensitive API with the fixed instruction length. Subsequent symbolic execution starting at this address will be based on the corresponding hook function. When the symbolic execution ends, organize and export the overall symbolic execution state information and the program basic block classification information.
[0020] In the above technical solution, step 3 specifically involves the following steps:
[0021] Step 3.1: Based on the basic block classification information obtained in A2, divide each basic block into six types: entry block, return block, main dispatcher, pre-dispatcher, real block, and useless block. Identify the nodes corresponding to each type of basic block in the static graph features. Based on the overall symbol execution status obtained in Step A2, find the real block nodes and the execution order of the real blocks, and mark these nodes and their corresponding paths.
[0022] Step 3.2: Based on the state information obtained in step A2, perform control flow reconstruction on the marked graph features in step 3.1, delete useless block nodes, connect real block nodes without branches to their corresponding successor real blocks, and for basic blocks that are simultaneously marked as entry blocks and real blocks, connect the basic block to the main dispatcher corresponding to the basic block, and jump to the main dispatcher to continue the repair operation. Repeat the above operation until all graph nodes have been traversed.
[0023] Compared with the prior art, the advantages of the present invention are as follows:
[0024] First, this invention generates a list of sensitive APIs and original graph features through static analysis of the APK. Then, hook functions are written for Android sensitive APIs not covered in traditional symbolic execution. At the same time, symbolic execution technology is combined to prune and reconstruct the original graph features. This method explores and improves the use of symbolic execution technology in the field of Android malware static analysis, reasonably represents it, and fills the gap in the ability of existing static analysis tools to repair static obfuscation. While retaining effective static graph feature information, it eliminates the influence of static obfuscation on static graph feature information, and achieves high accuracy in the identification of Android malware based on static analysis. Attached Figure Description
[0025] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0026] Figure 1 This is a simplified flowchart of the process structure of the present invention. Detailed Implementation
[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0028] This invention utilizes symbolic execution technology to statically repair obfuscation techniques employed by Android malware. It considers the compatibility of static analysis techniques with the Android system, and writes corresponding hook functions for sensitive APIs in Android applications based on a list of sensitive APIs, enabling dynamic replacement during simulated function execution. Our contribution lies in improving the accuracy of static detection of Android malware by combining symbolic execution technology with it. Specifically:
[0029] Preprocessing: Static analysis tools such as IDA Pro and Androguard are used to perform static analysis on the Android APK under test to obtain the original static graph features and generate a list of sensitive APIs.
[0030] Symbolic execution: Based on the obtained list of sensitive APIs, it replaces some functions in the Android application, and combines symbolic execution techniques to generate state information and basic block segmentation information.
[0031] Static graph feature restoration: The original graph features are restored based on state information and basic block segmentation information.
[0032] The specific process of the static remediation method for malicious code obfuscation based on symbolic execution is as follows: First, a preliminary static analysis of the Android APK is performed using static analysis tools such as DIAPro and Androguard to extract its original static graph features and a list of sensitive APIs present in the APK. Based on the list of sensitive APIs, corresponding hook functions are written to simulate their functionality. Then, symbolic execution technology is used to simulate the execution of the Android application. During this process, hook functions are used to replace actual functions according to the list of sensitive APIs, ultimately obtaining the state information and basic block segmentation information of the simulated execution of the Android application. Based on the basic block classification information, each graph node of the original graph features is marked to obtain marked graph features. Based on the state information, each marked node in the marked graph features of the step is reconnected, retaining valid block nodes and deleting useless block nodes to reconstruct the control flow. Finally, obfuscated nodes and paths are eliminated, and valid graph features are extracted.
[0033] Example
[0034] A static remediation method for malware obfuscation techniques based on symbolic execution, combining static analysis and symbolic execution, includes the following steps:
[0035] Step 1: Perform basic static analysis on the Android application under test to obtain a list of sensitive APIs and original graph features in the Android application under test;
[0036] Step 2: Based on the sensitive API list obtained in Step 1, write hook functions to simulate the functionality of the sensitive API list, generate a function replacement table, and use symbolic execution technology to simulate running the Android application. During this process, some functions are replaced according to the function replacement table, ultimately obtaining the overall execution status information and basic block segmentation information of the Android application during simulated execution. In Step 1, we obtained all the sensitive APIs existing in the tested Android application and summarized them into a sensitive API list. In Step 2, we need to use hook functions to replace all sensitive APIs because the internal implementation of sensitive APIs contains many function calls, but in reality, we only need information up to the sensitive API level. If hook functions are not used for replacement, symbolic execution will simulate the execution of functions inside the sensitive APIs, adding a lot of useless burden to the execution process. Furthermore, due to the differences between symbolic execution and real execution, there may be functions that cannot be simulated and need to be handled through function replacement.
[0037] Step 3: Based on the state information and block information, prune and reconstruct the original graph features to achieve static repair, eliminate static obfuscation information, and mine the effective graph features.
[0038] In the above technical solution, the specific steps of step 1 are as follows:
[0039] Using IDA Pro and Androguard static analysis tools, static analysis was performed on the .dex binary file inside the tested Android APK to obtain the original static graph features and its internal function list, confirming the presence of traditional Android sensitive APIs defined by Google and new sensitive APIs discovered in previous research, and generating a list of sensitive APIs.
[0040] In the above technical solution, the specific steps of step 2 are as follows:
[0041] Based on the obtained list of sensitive APIs, some functions in the Android application are replaced. Symbolic execution techniques are then used to generate state information and basic block segmentation information. The specific steps are as follows:
[0042] Step A1: Obtain the binary object of the Android application in memory. Confirm the starting address, instruction length, and register usage status of each sensitive API in the sensitive API list from Step 1. Write corresponding hook functions based on the original sensitive API function code logic and register usage status. Store the name of each sensitive API, the corresponding hook function name, the starting address of the sensitive API, and the instruction length as a function replacement table. Because existing symbolic execution technology is mainly for Windows systems and has less application in Android systems, many Android-specific APIs are not adapted, so custom code needs to be written here.
[0043] Step A2: Simulate the execution of the Android application using symbolic execution technology. Load the binary executable file in the Android APK into memory, convert all variables into symbolic variables, convert each instruction into a symbolic expression, solve the constraints according to the program instruction flow, modify the corresponding memory addresses and registers, and retain the state information of each stage and the corresponding basic block information. When the instruction that calls a sensitive API is executed, consult the function replacement table obtained in Step A1, and replace the function with the corresponding hook function starting at the starting address of the sensitive API with the fixed instruction length. Subsequent symbolic execution starting at this address will be based on the corresponding hook function. When the symbolic execution ends, organize and export the overall symbolic execution state information and the program basic block classification information.
[0044] In the above technical solution, step 3 specifically involves the following steps:
[0045] Step 3.1: Based on the basic block classification information obtained in A2, divide each basic block into six types: entry block, return block, main dispatcher, pre-dispatcher, real block, and useless block. Identify the nodes corresponding to each type of basic block in the static graph features. Based on the overall symbol execution status obtained in Step A2, find the real block nodes and the execution order of the real blocks, and mark these nodes and their corresponding paths.
[0046] Step 3.2: Based on the state information obtained in step A2, perform control flow reconstruction on the marked graph features in step 3.1, delete useless block nodes, connect real block nodes without branches to their corresponding successor real blocks, and for basic blocks that are simultaneously marked as entry blocks and real blocks, connect the basic block to the main dispatcher corresponding to the basic block, and jump to the main dispatcher to continue the repair operation. Repeat the above operation until all graph nodes have been traversed.
Claims
1. A static repair method for malicious code obfuscation techniques based on symbolic execution, characterized in that, The combined application of static analysis and symbolic execution includes the following steps: Step 1: Perform basic static analysis on the Android application under test to obtain a list of sensitive APIs and original graph features in the Android application under test; Step 2: Based on the sensitive API list obtained in Step 1, write hook functions to simulate the functionality of the sensitive API list, generate a function replacement table, and use symbolic execution technology to simulate running the Android application. During this process, some functions are replaced according to the function replacement table, and finally, the overall execution status information and basic block segmentation information of the Android application during simulated execution are obtained. Step 3: Based on the state information and block information, prune and reconstruct the original graph features to achieve static repair, eliminate static obfuscation information, and mine the effective graph features; The specific steps of step 2 are as follows: Based on the obtained list of sensitive APIs, some functions in the Android application are replaced. Symbolic execution techniques are then used to generate state information and basic block segmentation information. The specific steps are as follows: Step A1: Obtain the binary object of the Android application in memory, confirm the starting address, instruction length and register usage status of each sensitive API in the sensitive API list in Step 1, write the corresponding hook function according to the original sensitive API function code logic and register usage status, and store each sensitive API name, corresponding hook function name, sensitive API starting address and instruction length as a function replacement table. Step A2: Use symbolic execution technology to simulate the execution of the Android application. Load the binary executable file in the Android APK into memory, convert all variables into symbolic variables, convert each instruction into a symbolic expression, solve the constraints according to the program instruction flow, modify the corresponding memory addresses and registers, and retain the state information of each stage and the corresponding basic block information. When the instruction that calls a sensitive API is executed, query the function replacement table obtained in step A1, and replace the function with the corresponding hook function with the function of fixed instruction length starting from the starting address of the sensitive API. Subsequent symbolic execution starting from this address will be based on the corresponding hook function. When the symbolic execution ends, organize and export the overall symbolic execution state information and the program basic block classification information. The specific steps of step 3 are as follows: Step 3.1: Based on the basic block classification information obtained in A2, divide each basic block into six types: entry block, return block, main dispatcher, pre-dispatcher, real block, and useless block. Identify the nodes corresponding to each type of basic block in the static graph features. Based on the overall symbol execution status obtained in Step A2, find the real block nodes and the execution order of the real blocks, and mark these nodes and their corresponding paths. Step 3.2: Based on the state information obtained in step A2, perform control flow reconstruction on the marked graph features in step 3.1, delete useless block nodes, connect real block nodes without branches to their corresponding successor real blocks, and for basic blocks that are simultaneously marked as entry blocks and real blocks, connect the basic block to the main dispatcher corresponding to the basic block, and jump to the main dispatcher to continue the repair operation. Repeat the above operation until all graph nodes have been traversed.
2. The static repair method for malicious code obfuscation technology based on symbolic execution according to claim 1, characterized in that, The specific steps of step 1 are as follows: Using IDA Pro and Androguard static analysis tools, static analysis was performed on the .dex binary file inside the tested Android APK to obtain the original static graph features and its internal function list, confirming the presence of traditional Android sensitive APIs defined by Google and new sensitive APIs discovered in previous research, and generating a list of sensitive APIs.