Binary Fault Vulnerability Detection via Symbolic Execution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for simulating fault induction in software programs, such as concrete execution and symbolic execution, are limited in detecting fault vulnerabilities in binary files, leading to inaccuracies in identifying and inserting effective fault countermeasures.

Innovation Solution

A fault countermeasure application that operates on binary files, compiles source code to a binary file, analyzes the binary file for fault vulnerabilities by injecting faults during symbolic execution, and recompiles the source code with inserted fault countermeasures to protect against identified vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If concrete execution is used to simulate fault induction, then the software program can be executed with specific input values to identify fault vulnerabilities, but the types of faults that can be injected and the number of faults are limited

Engineering Contradiction:

Improvefault vulnerability detection capabilityVSAvoidtypes and number of injectable faults

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent uses an intermediate representation (IR) as a mediator between source code and binary code. The symbolic execution engine operates on this IR to inject diverse faults that would be difficult to inject directly in concrete execution, thereby expanding the types and number of faults that can be tested while maintaining execution efficiency

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces concrete execution with symbolic execution. Instead of executing the program with actual values (mechanical execution), it uses symbolic values and constraint solving to explore multiple execution paths and fault scenarios simultaneously, greatly expanding the versatility of fault injection

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Adaptability or versatility

If symbolic execution is used to analyze source code, then various faults can be injected to determine fault vulnerabilities, but the analysis is applied at higher-level representations which limits the accuracy of detected vulnerabilities

Engineering Contradiction:

Improvefault injection capabilityVSAvoidfault vulnerability detection accuracy

Core Design Contradiction:

Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The patent segments the analysis process into distinct stages: source code compilation to intermediate representation, symbolic execution on IR with fault injection, and binary code generation. This segmentation allows fault injection to occur at the IR level where diverse faults can be applied, while final verification happens at the binary level where precise vulnerability detection occurs

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent adds a new dimension to the analysis by introducing intermediate representation as an additional layer between source code and binary code. This dimensional addition enables symbolic execution and fault injection at a level that combines the versatility of high-level analysis with the precision of low-level binary analysis

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

3Ease of manufacture

If the fault countermeasure application operates on source code files, then the process can be simplified, but the accuracy of fault vulnerabilities detected in binary files decreases

Engineering Contradiction:

Improveprocessing simplicityVSAvoidfault vulnerability detection accuracy in binary

Core Design Contradiction:

Ease of manufactureVSMeasurement precision

Solution Approach 1:

The patent performs preliminary compilation of source code to intermediate representation before conducting symbolic execution and fault analysis. This preliminary action prepares the code in a form that enables both ease of processing and accurate binary-level vulnerability detection, resolving the contradiction between simplicity and precision

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20250181724A1Systems and methods for identifying software fault vulnerabilities and inserting fault countermeasures

Publication Date: 2025.06.05 THE MITRE CORPORATION

AI summary

A method for automatically generating a compiled binary file with fault countermeasures includes compiling, by a compiler, a source code file to a first binary file; analyzing the first binary file to identify one or more fault vulnerabilities in the first binary file, wherein analyzing the first binary file to identify the one or more fault vulnerabilities includes: injecting a set of faults into the first binary file during a symbolic execution of the first binary file to generate a set of faulted states of the first binary file; and identifying the one or more fault vulnerabilities from the set of faulted states, wherein the one or more fault vulnerabilities are fault vulnerabilities that cause the first binary file to violate at least one security requirement; and compiling, by the compiler, the source code file to a second binary file, wherein the compiler inserts a set of fault countermeasures into the second binary file based on the identified one or more fault vulnerabilities, wherein the set of fault countermeasures protect the second binary file against the one or more fault vulnerabilities.