Software Binary Fingerprinting via Intermediate Representation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing use of third-party components with few security checks leads to difficulties in detecting vulnerabilities in stripped, statically-linked binaries, resulting in security breaches due to arbitrary code execution and buffer over-read vulnerabilities.
Innovation Solution
A system comprising a processor and memory that filters a platform-independent intermediate representation to a filtered representation and executes it on a virtual machine to produce an output vector, which is used to generate a function fingerprint, independent of machine architecture or compiler, thereby identifying code vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security scanning methods are used on stripped, statically-linked binaries, then the scanning process can be performed, but the ability to accurately detect vulnerabilities is reduced due to lack of symbol information and compiler optimizations
Solution Approach 1:
The patent introduces an intermediary process that translates binary code into a standardized intermediate representation (IR), which serves as a mediator between the complex binary analysis and the vulnerability detection algorithms. This IR format preserves semantic information while being platform-independent, enabling accurate vulnerability detection without requiring symbol information or understanding of compiler-specific optimizations.
Solution Approach 2:
The patent transforms the binary code from its original complex format into a simplified intermediate representation with changed parameters including standardized instruction encoding, normalized control flow representation, and abstracted data types. This parameter transformation maintains the essential semantic information needed for vulnerability detection while removing compiler-specific and platform-specific variations that complicate analysis.
2Reliability
If comprehensive security analysis is performed on third-party components, then vulnerability detection capability is improved, but the processing time and computational resources increase significantly
Solution Approach 1:
The patent segments the binary code into discrete basic blocks and control flow graphs, analyzing each segment independently through the intermediate representation. This segmentation allows the system to process only the relevant portions of the binary code needed for vulnerability detection, rather than performing exhaustive analysis on the entire binary, thus improving processing efficiency while maintaining detection capability.
Solution Approach 2:
The patent creates a simplified copy of the binary code in the form of an intermediate representation that captures the essential semantic information needed for vulnerability detection. This copy is platform-independent and standardized, allowing rapid analysis without requiring access to the original complex binary format, thereby improving processing speed while maintaining detection accuracy.
3Measurement precision
If symbolic execution is used to achieve precise vulnerability detection, then detection accuracy is improved, but the processing speed decreases due to the exhaustive nature of symbolic execution
Solution Approach 1:
The patent applies partial action by performing selective analysis on the intermediate representation, focusing only on the control flow paths and data dependencies that are relevant to vulnerability detection. Rather than executing all possible symbolic paths exhaustively, the system identifies and analyzes only the critical paths that could lead to vulnerabilities, maintaining precision while improving speed.
Solution Approach 2:
The patent replaces the mechanical symbolic execution process with a static analysis approach operating on the intermediate representation. This substitution uses graph-based analysis and data flow analysis on the IR instead of actual execution, achieving comparable precision in vulnerability detection while dramatically improving processing speed by avoiding the overhead of symbolic execution engine operations.
Data Source
AI summary
Systems, computer-implemented methods, and computer program products that facilitate identifying computer software vulnerabilities, and more specifically, execute an approximate representation of software to produce a fingerprint are provided. In one example, a system is provided. The system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can include a filter component and an execution component. The filter component can filter a platform-independent intermediate representation to a filtered representation. The execution component can execute the filtered representation on a virtual machine to produce an output vector which can be used to identify computer software vulnerabilities.