Binary Code Security Risk Analysis via Network Protocol Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Binary software code submitted without source code poses challenges in identifying and addressing security risks associated with network protocols used, as the binary format is not readable, making it difficult to inspect and modify protocols to ensure security.
Innovation Solution
A method and system that utilize a network protocol analyzer to identify network addresses within binary software code, assess the security of used protocols, generate notifications, and patch insecure protocols with secure ones, allowing for dynamic security risk assessment and improvement without executing the code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If binary software code is submitted without source code for security assessment, then submission efficiency is improved, but the ability to identify and inspect network protocols deteriorates
Solution Approach 1:
The patent creates a copy of the binary software code and performs static analysis on the copy without executing it. This allows security assessment of network protocols in the binary form without requiring source code, maintaining submission efficiency while enabling protocol inspection through copying and analysis of the binary representation
Solution Approach 2:
The patent introduces an intermediary static analysis process that acts as a mediator between the submitted binary code and the security assessment system. This intermediary layer extracts and analyzes network protocol information from the binary code without requiring execution or source code access, resolving the contradiction between efficiency and inspectability
2Reliability
If binary software code is analyzed without execution, then system safety is improved, but the precision of security risk identification deteriorates
Solution Approach 1:
The patent performs preliminary static analysis on the binary software code before execution to identify network protocol usage patterns, data flow, and potential security risks. This preliminary action captures protocol information in advance without requiring code execution, maintaining system safety while improving identification precision through proactive analysis
Solution Approach 2:
The patent segments the binary software code analysis into distinct components: identifying network protocol calls, analyzing data flow between protocols and external systems, and evaluating security risks separately. This segmentation allows comprehensive security assessment without execution, improving precision by systematically examining each aspect of protocol usage
3Ease of repair
If network protocols in binary code are patched without source code access, then ease of repair is improved, but manufacturing precision deteriorates
Solution Approach 1:
The patent creates modified copies of the binary software code with patched network protocol implementations. Instead of directly modifying the original binary code, it generates corrected versions, maintaining ease of repair while preserving the integrity and precision of the original manufacturing process
Solution Approach 2:
The patent introduces an intermediary patching process that operates on binary code representations rather than direct source code modification. This intermediary approach applies security patches to network protocols in the binary form, maintaining ease of repair for deployed systems while avoiding precision loss that would occur with direct binary manipulation
Data Source
Figure 1~2
Figure 3
AI summary
Systems, methods, and software can be used to analyze security risks of a binary software code. In some aspects, a computer-implemented method comprises: receiving, by at least one hardware processor, a binary software code; determining, by the at least one hardware processor, that the binary software code accesses one or more network addresses; for each of the one or more network addresses that are accessed by the binary software code: determining, by the at least one hardware processor, whether the binary software code uses an insecure network protocol to access the network address; and generating, by the at least one hardware processor, a security notification indicating the network address that is accessed by the binary software code using the insecure network protocol.