Binary Control Flow Graph Analysis for Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional black box tests for detecting security vulnerabilities in programs are inefficient, often missing deep route vulnerabilities and requiring excessive computation, especially when source code is not available for analysis.
Innovation Solution
A method and system for detecting security vulnerabilities through binary analysis, which generates route information, acquires crash data, restores a control flow graph, calculates complexity, and performs route detection only when complexity is below a threshold, generating new test cases and outputting crash information to external devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If conventional black box test is used to detect security vulnerabilities, then source code analysis is avoided, but detection accuracy for deep route vulnerabilities deteriorates and computation required increases
Solution Approach 1:
The patent segments the vulnerability detection process into two distinct phases: a filtering phase that uses binary-level control flow graph analysis to identify low-complexity routes, and a detailed analysis phase that performs comprehensive vulnerability detection only on those filtered routes. This segmentation allows the system to avoid exhaustive analysis of all possible execution routes while still capturing deep route vulnerabilities, thereby resolving the contradiction between ease of detection and detection accuracy.
Solution Approach 2:
The patent changes the analysis parameter from source code level to binary level by restoring control flow graphs from binary executables. This parameter change enables the system to work without source code while maintaining the ability to analyze execution routes. The system calculates complexity metrics on the restored binary control flow graphs and uses these metrics to filter routes, achieving both ease of detection (no source code needed) and adequate detection accuracy (through intelligent filtering).
2Reliability
If comprehensive route detection is performed on all execution routes, then vulnerability detection coverage is improved, but computational complexity increases excessively
Solution Approach 1:
The patent applies partial action by performing comprehensive vulnerability detection only on a subset of execution routes that are identified as having low complexity. Instead of analyzing all possible routes, the system filters routes based on complexity metrics derived from binary control flow graphs and focuses computational resources on the most promising candidates. This partial analysis approach maintains adequate detection coverage while dramatically reducing computational complexity.
Solution Approach 2:
The patent performs preliminary filtering of execution routes based on complexity analysis before conducting detailed vulnerability detection. By restoring the binary control flow graph and calculating route complexities in advance, the system identifies and prioritizes low-complexity routes that are more likely to contain vulnerabilities. This preliminary action reduces the search space for subsequent detailed analysis, balancing coverage and computational requirements.
Data Source
AI summary
Provided are a method and a system capable of efficiently detecting security vulnerability of program. The method includes: generating binary information including route information indicating an execution route of a program on a first test case; acquiring first crash information including the first test case and the route information when a crash of the first test case occurs; restoring a control flow graph based on the binary information; calculating complexity of the restored control flow graph; determining whether the complexity is less than a threshold value; only when a result of the determination indicates that the complexity is less than a threshold value, performing: executing a route detection on the route information; generating a second test case by executing the route detection; and acquiring a second crash information including the second test case and the route information.