Binary Code Anomaly Detection via Pseudo-Source Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to detect software anomalies and cybersecurity issues in binary code without source code or executing the binary code, making it difficult to identify malicious or harmful software behaviors.
Innovation Solution
A method and system that analyze executable binary code using machine-readable specifications to define control flow patterns and dataflow constraints, allowing for the identification of execution paths and argument satisfaction, thereby detecting predetermined software actions without executing the code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis is performed on binary code to detect software anomalies, then cybersecurity detection capability is improved, but analysis accuracy deteriorates due to lack of source code and execution context
Solution Approach 1:
The patent introduces an intermediary layer that translates binary code into a pseudo-source code representation, enabling static analysis tools to work with binary code as if it were source code. This intermediary representation preserves the logical structure and control flow of the original binary code, allowing accurate detection of security anomalies without requiring actual source code or execution.
2Measurement precision
If binary code is executed to identify software behaviors, then detection accuracy is improved, but system security deteriorates due to potential malicious actions
Solution Approach 1:
The patent performs preliminary analysis by translating binary code into pseudo-source code representation and conducting static analysis before any execution occurs. This preliminary action identifies potential malicious behaviors, control flow patterns, and data flow anomalies in advance, allowing the system to block or flag suspicious code without actually executing it, thereby maintaining security while achieving detection accuracy.
3Measurement precision
If source code is available for analysis, then analysis precision is improved, but ease of operation deteriorates due to unavailability of binary code scenarios
Solution Approach 1:
The patent creates a copy of the binary code in the form of pseudo-source code representation that mimics the structure and logic of actual source code. This copied representation can be manipulated and analyzed using standard static analysis techniques designed for source code, making the analysis process as easy and familiar as working with source code while operating on binary code that may be the only available form.
Data Source
AI summary
A method includes receiving executable binary code and a machine-readable specification that (1) defines a control flow pattern and a dataflow constraint and (2) is associated with a library function call. A target of a library function call site is retrieved, the library function call site being associated with the library function call and included in the executable binary code. An indication of an execution path in the executable binary code is identified based on the control flow pattern the target. An argument of the library function call is identified based on the dataflow constraint, the target, and the indication of the execution path. The method also includes determining, using solver software, that the argument satisfies the dataflow constraint defined by machine-readable specification. In response to the determining, a signal that indicates that the executable binary code is associated with a predetermined software action is transmitted.