Binary Weakness Detection Using Decompiled AI Training
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing CWE binary code scanners struggle to detect weaknesses accurately due to the difficulty in defining binary patterns, reliance on up-to-date patterns, and the unreliability of generative AI models prone to hallucination.
Innovation Solution
A method utilizing two generative AI models to convert vulnerable source code snippets into compilable and executable binary codes, followed by decompiling and training a weakness detection model to identify weaknesses in decompiled codes, ensuring accurate detection through contextual understanding and minimizing hallucination.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional CWE binary code scanners are used, then detection capability is provided, but detection accuracy deteriorates due to difficulty in defining binary patterns and reliance on up-to-date patterns
Solution Approach 1:
The patent introduces an intermediary layer by converting binary code into decompiled code that resembles original source code. This intermediary representation preserves the logical structure and control flow of the binary while making it readable and analyzable by AI models, thus resolving the complexity of directly analyzing binary patterns.
Solution Approach 2:
The patent creates a copy of the binary code in the form of decompiled code that replicates the original source code's logical structure. This copy maintains the essential characteristics needed for weakness detection while being much easier to analyze, eliminating the need to work with complex binary patterns directly.
2Productivity
If generative AI models are used to detect weaknesses, then detection capability is enhanced, but reliability deteriorates due to hallucination
Solution Approach 1:
The patent implements feedback mechanisms where the AI model's predictions are verified against the actual binary code execution behavior. The system uses ground truth labels from successful weakness detections and adjusts the model accordingly, reducing hallucinations through continuous feedback from actual code behavior.
Solution Approach 2:
The patent performs preliminary actions by converting binary code into decompiled code form before AI analysis. This preliminary transformation prepares the data in a format that is easier for AI models to process accurately, reducing the likelihood of hallucination during the detection phase.
3Ease of operation
If binary code is decompiled to source code form, then analysis ease is improved, but information loss may occur
Solution Approach 1:
The patent segments the analysis process into distinct stages: binary code decompilation, AI-based weakness detection on decompiled code, and verification against original binary behavior. This segmentation allows each stage to optimize for its specific purpose while maintaining overall information integrity through controlled transformations.
Solution Approach 2:
The patent changes the representation parameters of the code from binary format to decompiled source code format. This parameter transformation makes the code much easier to analyze while preserving the essential logical structure and control flow information needed for weakness detection, minimizing information loss.
Data Source
AI summary
Weaknesses are detected in binary codes. Vulnerable code snippets are completed into corresponding compilable codes that are in source code form using a generative artificial intelligence (AI) model. The compilable codes are compiled into corresponding binary codes. The binary codes are decompiled into decompiled codes that are in source code form. The decompiled codes are used as training data to train another generative AI model to detect one or more weaknesses that may be present in target decompiled codes. A target binary code is detected to have a weakness when the other generative AI model identifies the weakness in a corresponding target decompiled code of the target binary code.