Binary Backdoor Detection Using Direct Code Graph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to detect backdoors in binary software code inserted during the build process, as they rely on recreating source code from binaries, leading to inefficiencies and high false positives.
Innovation Solution
A method that leverages binary inspection and backdoor abstractions to classify potential backdoors, then backtracks to the source code to verify their presence, reducing false positives and enhancing detection speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If source code is recreated from binary software code for backdoor detection, then detection capability is achieved, but detection speed decreases and false positives increase
Solution Approach 1:
Instead of recreating source code from binary code to detect backdoors, the patent inverts the approach by directly analyzing binary code using static analysis techniques. The system extracts control flow graphs, data flow graphs, and call graphs directly from the binary, then applies backdoor detection algorithms to these extracted structures, eliminating the time-consuming source code recreation step while maintaining detection accuracy.
Solution Approach 2:
The patent extracts specific structural elements (control flow graphs, data flow graphs, call graphs) directly from the binary code that are most relevant for backdoor detection. By extracting only the necessary analytical structures rather than recreating entire source code, the system achieves efficient detection with reduced computational overhead and fewer false positives.
2Reliability
If source code is recreated from binary software code for backdoor detection, then detection capability is achieved, but time consumption increases
Solution Approach 1:
The patent performs preliminary extraction of control flow graphs, data flow graphs, and call graphs from the binary code before applying backdoor detection algorithms. This preliminary structuring of the binary code analysis prepares the data in advance in a format optimized for detection, eliminating the need for time-consuming source code recreation during the actual detection process and significantly reducing total detection time.
3Productivity
If binary code is directly analyzed without source code recreation, then detection speed improves, but detection precision may worsen
Solution Approach 1:
The patent applies different analysis techniques to different parts of the binary code structure. Control flow graphs are analyzed for execution path anomalies, data flow graphs for suspicious data transformations, and call graphs for unusual function invocation patterns. By tailoring the analysis approach to the specific structural characteristics of each extracted graph, the system maintains high detection precision while working directly with binary code.
Data Source
AI summary
Systems, methods, and software can be used to detect backdoors in binary software code. In some aspects, a method comprises: obtaining, by a server, binary software code corresponding to source code; generating, by the server, a backdoor abstraction of the binary software code; and generating, by the server, a backdoor risk assessment based on the backdoor abstraction of the binary software code.