Binary Code Block Scoring for Broad Backdoor Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing program analysis methods are limited in their ability to detect various types of backdoors in software, as they focus on specific backdoor types, failing to provide comprehensive inspection capabilities.

Innovation Solution

A program analysis apparatus and method that extracts code blocks with specific properties and performs backdoor scoring based on control flow relationships, allowing for accurate identification of potential backdoors by calculating a backdoor score for each code block, considering its relationship with sensitive operations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If scoring is performed only on code blocks with specific properties (e.g., dead code), then the detection method is simple and fast, but it cannot detect various types of backdoors

Engineering Contradiction:

Improvebackdoor type coverageVSAvoidanalysis method complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent creates a universal backdoor detection framework that handles multiple backdoor types through a common scoring mechanism. The system extracts various code block types (dead code, code with sensitive operations, code with abnormal control flow) and applies a unified scoring method that adapts to different backdoor characteristics, making the detection method versatile across different backdoor types without requiring separate specialized methods for each type

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent segments the code base into different code block types (dead code blocks, code blocks with sensitive operations, code blocks with abnormal control flow) and applies specific extraction methods to each segment. This segmentation allows the system to handle diverse backdoor types by targeting specific code characteristics while maintaining an overall unified detection framework

Inventive Principle:

Principle #1Segmentation

2Measurement precision

If comprehensive code analysis is performed to detect all backdoor types, then detection accuracy improves, but analysis time and computational resources increase

Engineering Contradiction:

Improvebackdoor detection accuracyVSAvoidanalysis time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent performs partial analysis by focusing on specific code block types that are more likely to contain backdoors (dead code, code with sensitive operations, code with abnormal control flow) rather than analyzing the entire code base uniformly. This selective approach maintains high detection accuracy for backdoor types while reducing overall analysis time by excluding code blocks that are unlikely to contain backdoors

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent applies different analysis depths and scoring criteria to different code block types based on their local characteristics. For example, dead code blocks receive one type of scoring while code blocks with sensitive operations receive another type of scoring. This localized approach optimizes detection accuracy for each code type while minimizing unnecessary analysis elsewhere

Inventive Principle:

Principle #3Local quality

3Adaptability or versatility

If multiple code block types are extracted and scored, then various backdoor types can be detected, but false positives increase

Engineering Contradiction:

Improvebackdoor type coverageVSAvoidfalse positive rate

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent merges the scoring results from multiple code block types (dead code scoring, sensitive operation scoring, control flow scoring) into a unified backdoor score. By combining these different scoring perspectives, the system achieves more reliable detection with reduced false positives, as a code block must exhibit suspicious characteristics across multiple dimensions to be flagged as a backdoor

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS12536091B2Program analysis apparatus, program analysis method, and non-transitory computer readable medium storing program

Publication Date: 2026.01.27 NEC CORP

AI summary

A program analysis apparatus includes a first code block extraction means for extracting a first code block having a specific property from codes included in a binary of a program, a second code block extraction means for extracting a second code block performing a predetermined sensitive operation from the codes included in the binary of the program, a relationship information acquisition means for acquiring relationship information indicating a relationship on a control flow between the first code block and the second code block, a backdoor score calculation means for calculating a backdoor score based on content of the predetermined sensitive operation in the first code block and performing addition and subtraction of the backdoor score with respect to the first code block based on the relationship information, and an output means for outputting the first code block and the backdoor score for the first code block.