Dataflow Graph Embeddings for Binary Function Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying core and shared libraries and functions in unknown application binaries are inadequate, particularly in cases where compiler optimization levels and architectures differ, leading to false negatives in software security assessments.
Innovation Solution
The system generates dataflow-based function signatures by extracting functions from application binaries, generating dataflows, creating dataflow graphs, converting these graphs into embeddings, and populating a knowledge base. It then uses similarity functions to determine matches between unlabeled and labeled application binaries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional binary comparison methods are used to identify functions in application binaries, then the process is simple and fast, but the identification accuracy deteriorates when compiler optimization levels and architectures differ
Solution Approach 1:
The patent transforms the binary comparison approach by changing the parameter representation from raw binary code to dataflow graph embeddings. This parameter transformation enables accurate function identification across different compiler optimizations and architectures while maintaining a manageable system complexity through standardized embedding dimensions and similarity thresholding.
Solution Approach 2:
The patent replaces the mechanical binary comparison system with a dataflow-based semantic analysis system. Instead of directly comparing binary instructions, the system extracts dataflow relationships and converts them to embeddings, substituting the mechanical comparison process with a more sophisticated but accurate semantic matching approach.
2Measurement precision
If dataflow graphs are converted into embeddings with high dimensionality to capture detailed function characteristics, then the identification accuracy improves, but the computational overhead and storage requirements increase
Solution Approach 1:
The patent optimizes the embedding parameter dimensions to achieve an optimal balance between accuracy and computational efficiency. By carefully selecting the embedding dimension size, the system captures sufficient function characteristics for accurate matching while avoiding the excessive computational overhead that would result from overly high-dimensional representations.
Solution Approach 2:
The patent applies partial action by using a subset of the most important dataflow features for embedding generation, rather than processing all possible features. This selective approach maintains high matching accuracy while reducing the computational resources required for embedding generation and comparison.
3Reliability
If comprehensive dataflow analysis is performed on all application binaries to build a knowledge base, then the coverage and reliability of vulnerability detection improve, but the time and computational resources required increase significantly
Solution Approach 1:
The patent performs preliminary action by pre-processing application binaries and generating their dataflow embeddings in advance, storing them in a knowledge base before actual vulnerability scanning. This preliminary preparation significantly reduces the time required during actual security assessments, as the system only needs to compare new binaries against the pre-built embedding database rather than performing full analysis each time.
Solution Approach 2:
The patent creates simplified copies of the original binary data in the form of dataflow embeddings. These embedding copies capture the essential functional characteristics needed for vulnerability detection while requiring far less storage space and enabling much faster comparison operations than storing and analyzing complete binary data.
Data Source
AI summary
An approach is provided for creating dataflow-based function signatures. Using intermediate representations of application binaries of respective applications, functions included in the application binaries are extracted. Respective dataflows are generated for the extracted functions. Respective dataflow graphs are generated for the dataflows. The dataflow graphs are converted into respective sets of embeddings. A knowledge base in a data repository is populated with the sets of embeddings. Using a first similarity function, a second similarity function, and the populated knowledge base, it is determined that an unlabeled application binary matches one of the application binaries.