Binary Library Identification Using Normalized Type Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying libraries used by a software application without accessing the source code is challenging due to the complexity of binary code, which is often optimized and varies across different programming languages and coding styles, making deep comparison costly and less accurate.
Innovation Solution
A system that extracts raw type data from application binaries, normalizes it to generate target normalized type data, and uses a model to index this data as an indexed data type, allowing for the identification of candidate library types by comparing with a database of known library types without accessing the source code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep comparison of binary code is performed to identify libraries, then identification accuracy is improved, but computational cost and time increase significantly
Solution Approach 1:
The patent segments the binary code comparison task into two stages: first comparing type information (a simplified representation) to generate candidate libraries, then performing deep comparison only on those candidates. This segmentation reduces the overall comparison time while maintaining identification accuracy by avoiding full deep comparison of all possible libraries.
Solution Approach 2:
The patent performs preliminary extraction and comparison of type information from binary code before conducting deep comparison. By pre-identifying candidate libraries through type data analysis, the system prepares a narrowed-down set of candidates that require full deep comparison, thus reducing total computational time while preserving accuracy.
2Measurement precision
If deep comparison of binary code is performed to identify libraries, then identification accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent divides the complex binary code comparison into simpler sub-tasks: extracting type information, normalizing it, comparing normalized type data to identify candidates, and then performing deep comparison only on candidates. This segmentation reduces computational complexity by breaking down the intractable full-comparison problem into manageable stages.
Solution Approach 2:
The patent introduces normalized type information as an intermediary representation between raw binary code and final library identification. This intermediary form simplifies the comparison process by providing a standardized, human-readable representation of code structure and semantics, reducing the complexity of direct binary code comparison.
3Speed
If code optimization is applied to improve performance, then execution speed is improved, but code similarity determination becomes more difficult
Solution Approach 1:
The patent extracts type information from optimized binary code, which serves as a stable fingerprint that remains relatively unchanged by optimizations. By taking out this invariant structural information for comparison, the system can identify libraries in optimized code without being hindered by the transformations applied during compilation.
Solution Approach 2:
The patent transforms binary code into normalized type information, changing the representation parameter from raw bytecode to structured type data. This parameter change makes the code representation more amenable to similarity detection, as type information preserves semantic meaning while being less sensitive to optimization-induced variations.
Data Source
AI summary
A system and a method are disclosed for identifying libraries used by an application based on the program code of the application. The system accesses a plurality of program codes of the application. For at least one program code, the system extracts raw type data from the program code and normalizes the raw type data to generate target normalized type data. The target normalized type data includes data type information of the program code. The system determines a set of candidate library types corresponding to the program code. The system accesses candidate raw type data associated with each candidate library type and determines a library type corresponding to the program code by comparing the program code of the application with the program code of each of the set of the candidate library types.