Binary Code Network Address Analysis for Security Risk Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Determining security risks in binary software code is challenging due to its non-readable format, making it difficult to inspect for vulnerabilities, especially related to network communication protocols.
Innovation Solution
Analyze binary software code by identifying network addresses within the code, establishing connections to these addresses, and assessing the security protocols and procedures configured by the network entities, determining security level information based on these interactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If binary software code is analyzed in its native format, then analysis accuracy is improved, but readability and inspectability deteriorate
Solution Approach 1:
The patent uses an intermediary translation layer that converts binary code into a readable intermediate representation (IR) format. This IR serves as a mediator between the binary format (which provides analysis accuracy) and human inspectors (who need readability). The translation process preserves security-relevant information while making the code inspectable without executing the original binary
Solution Approach 2:
The patent replaces manual inspection of binary code (mechanical process) with automated translation and analysis systems. The system automatically translates binary to IR, performs security analysis, and generates reports, substituting the manual mechanical process of reading binary with an automated computational process that achieves both accuracy and readability
2Reliability
If binary software code is executed for analysis, then dynamic behavior is captured, but security risks during execution increase
Solution Approach 1:
The patent performs preliminary translation of binary code to intermediate representation before any security analysis or testing occurs. This preliminary action creates a safe, sandboxed version of the code that can be analyzed without executing the original binary, thus capturing dynamic behavior information while eliminating the risk of actual damage during the analysis process
Solution Approach 2:
The patent creates a copy of the binary code in the form of an intermediate representation that preserves the functional and security characteristics of the original. This copy can be analyzed and tested without risking the original system, allowing comprehensive security assessment while isolating potential harmful effects to the analysis environment only
3Measurement precision
If comprehensive security analysis is performed, then security risk detection is improved, but analysis time increases
Solution Approach 1:
The patent segments the security analysis process into distinct phases: translation to intermediate representation, static analysis of the IR, and selective dynamic analysis. This segmentation allows the system to perform comprehensive security checks by breaking down the complex analysis into manageable stages, improving detection capability while managing time through structured processing
Solution Approach 2:
The patent applies partial analysis actions by focusing security inspection on specific high-risk areas of the code identified during the translation phase. Rather than uniformly analyzing every portion of the code at maximum depth, the system performs targeted analysis on critical sections, achieving effective vulnerability detection while reducing overall analysis time through selective inspection
Data Source
Figure 1~2
Figure 3
AI summary
Systems, methods, and software can be used to analyze security risks of a set of binary software code. In some aspects, a computer-implemented method comprises: scanning, by at least one hardware processor, a set of binary software code to identify one or more network addresses accessed by the set of binary software code; for each of the one or more network addresses: determining, by the at least one hardware processor, security level information of the network addresses; and generating, by the at least one hardware processor, a security notification based on the determined security level information for the one or more network addresses, wherein the security notification indicates a security risk of the set of binary software code.