Compiler Security Flaw Detection via IR Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods are inadequate for detecting compiler-injected security flaws, as they fail to effectively compare and identify discrepancies between source code and compiled code, particularly due to compiler optimizations such as code inlining and operation reordering.
Innovation Solution
A computer-implemented method and system that reverse engineers compiled code and performs a statistical comparison with the original source code to identify differences, using a statistical comparison tool that accounts for compiler optimizations and generates a list of discrepancies for further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If compiler optimizations such as code inlining and operation reordering are applied, then execution efficiency is improved, but detection accuracy deteriorates due to discrepancies between source code and compiled code
Solution Approach 1:
The patent introduces an intermediary representation (IR) as a mediator between source code and compiled code. The IR captures the semantic meaning and control flow of the source code in a form that is easier to compare with optimized compiled code, while preserving the original program's logic. This intermediary layer allows for accurate detection of security flaws even when compiler optimizations are applied, as the IR can be compared against the actual compiled behavior to identify discrepancies.
Solution Approach 2:
The patent creates a copy of the source code's semantic structure in the form of an intermediary representation. This copy preserves the essential logic and control flow without being affected by compiler optimizations, allowing for direct comparison with the compiled code to detect security flaws introduced during compilation.
2Reliability
If detailed comparison between source code and compiled code is performed, then detection capability is improved, but system complexity increases
Solution Approach 1:
The patent segments the code comparison process into distinct phases: source code analysis to generate IR, compilation to object code, and comparison between IR and decompiled object code. This segmentation allows each phase to be handled independently with appropriate tools and techniques, reducing overall system complexity while maintaining high detection capability.
Solution Approach 2:
The intermediary representation serves as a simplified mediator that captures essential program semantics without the full complexity of either source code syntax or compiled machine code. This intermediary layer reduces the complexity of comparison by providing a common, simplified representation that preserves security-relevant information.
3Measurement precision
If statistical comparison methods are used, then false positives are reduced, but processing time increases
Solution Approach 1:
The patent applies statistical comparison methods selectively to only those code regions that are suspected of containing security flaws, rather than performing exhaustive statistical analysis on the entire codebase. This partial action approach reduces processing time while maintaining high precision in detecting actual security issues.
Solution Approach 2:
The patent performs preliminary analysis to identify suspicious code regions before applying statistical comparison methods. By pre-identifying areas of interest based on simple heuristics or static analysis, the system can then apply more time-consuming statistical methods only where needed, reducing overall processing time while maintaining high detection accuracy.
Data Source
AI summary
A computer-implemented method is provided for detecting compiler-injected security flaws. The computer-implemented method includes receiving source code, compiling the source code, reverse engineering the compiled source code, comparing operations performed by the source code and the reverse engineered source code, identifying differences between the source code and the reverse engineered source code, and creating a list of differences. The list of differences includes operations that are present in the source code and missing from binary code. Alternatively, the list of differences includes operations that are present in binary code and missing from the source code.