Binary Cloning for Vulnerability Detection in Closed-Source Software

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current vulnerability detection techniques require access to source code to detect vulnerabilities using code clones, making it difficult for software with restricted or no source code availability to identify unknown vulnerabilities.

Innovation Solution

A vulnerability detection device that extracts and normalizes program code, calculates similarity with known vulnerability code, and determines unknown vulnerabilities without requiring source code, using a disassembling unit, normalization processing unit, similarity calculating unit, and determining unit.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If vulnerability detection uses code clone technique with source code extraction, then vulnerability detection accuracy is improved, but applicability to software without source code availability deteriorates

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoidapplicability to software without source code

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent uses binary cloning technology to create a virtual copy of the target software's executable file. This cloned binary image allows the system to extract vulnerability information and compare code clones without requiring access to the original software's source code, thus resolving the contradiction between detection accuracy and applicability to closed-source software

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent introduces a binary image as an intermediary between the vulnerability detection system and the target software. By converting the software into a binary image that can be analyzed and cloned, the system enables vulnerability detection without direct access to source code, maintaining both detection accuracy and versatility

Inventive Principle:

Principle #24Intermediary (Mediator)

2Difficulty of detecting and measuring

If vulnerability detection requires source code access, then code clone analysis is enabled, but ease of operation for privately owned software deteriorates

Engineering Contradiction:

Improvevulnerability detection capabilityVSAvoidease of vulnerability detection for closed-source software

Core Design Contradiction:

Difficulty of detecting and measuringVSEase of operation

Solution Approach 1:

The system creates a virtual copy of the software's binary executable, allowing vulnerability detection operations to be performed on the clone without requiring source code access. This enables easy operation on privately owned software while maintaining full vulnerability detection capability through code clone analysis

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent replaces the traditional mechanical approach of manually analyzing source code with an automated binary image cloning and analysis system. This substitution eliminates the need for source code access while enabling automated vulnerability detection, significantly improving ease of operation

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10747887B2Vulnerability detection device, vulnerability detection method, and vulnerability detection program

Publication Date: 2020.08.18 NIPPON TELEGRAPH & TELEPHONE CORP

AI summary

A vulnerability detection device includes a vulnerability portion extracting unit that extracts a first program code corresponding to an uncorrected vulnerability portion of software, a normalization processing unit that normalizes a parameter varying depending on compilation environment, among parameters included in the extracted first program code and in a second program code of software as a target to be tested for the vulnerability portion, a similarity calculating unit that calculates a similarity of an arbitrary portion of the second program code after normalization as a comparison target to the first program code, and a determining unit that refers to vulnerability related information for a portion of the second program code in which the calculated first similarity exceeds a predetermined threshold, and that determines whether the portion of the second program code is an unknown vulnerability portion.