Indirect Function Call Target Identification Using Graph Neural Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying indirect function call targets in software are not precise enough, leading to high false-positive and false-negative rates, which affects program analysis, especially for large programs like operating system-level software.
Innovation Solution
A computer-implemented method using explicit data dependency analysis and dynamic execution analysis to generate ground-truth indirect function call targets, combined with feature embeddings from a graph neural network to expand and refine the target identification, reducing false-positive and false-negative rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional methods are used to identify indirect function call targets, then the process is simpler and faster, but the precision is low with high false-positive and false-negative rates
Solution Approach 1:
The patent segments the identification process into three distinct phases: explicit data dependency analysis to establish candidate sets, dynamic execution analysis to filter candidates based on runtime behavior, and machine learning-based classification to finalize target identification. This segmentation allows each phase to focus on specific aspects, improving overall precision while managing complexity through modular processing.
Solution Approach 2:
The patent introduces an intermediary classification model trained on program characteristics that acts as a bridge between raw execution data and final target identification. This intermediary layer processes and refines the data from execution analysis, reducing false positives and negatives by learning patterns that simple rule-based systems miss, thereby improving precision without requiring complete restructuring of the analysis pipeline.
2Reliability
If comprehensive analysis is performed to reduce false positives, then identification accuracy improves, but analysis time increases
Solution Approach 1:
The patent performs preliminary explicit data dependency analysis before dynamic execution analysis to pre-establish candidate function sets. This preliminary action filters out obviously incorrect candidates early, reducing the search space for subsequent analysis and allowing comprehensive checking of remaining candidates without excessive time cost. The multi-phase approach ensures reliability through thorough analysis while managing time through staged processing.
Solution Approach 2:
The patent applies partial analysis by focusing dynamic execution monitoring only on identified candidate functions rather than all possible functions. This selective approach provides sufficient analysis depth for reliability on critical candidates while avoiding the time cost of exhaustive analysis of every potential target, achieving a balance between comprehensive verification and time efficiency.
Data Source
AI summary
Indirect function call target identification in software is provided. A set of explicit data flows that pass a function address between software modules of a program is determined using an explicit data dependency analysis. A set of indirect function call targets is generated from results of the explicit data dependency analysis and a dynamic execution analysis of the program. The set of indirect function call targets is expanded by identifying similar target functions based on feature embeddings generated by a graph neural network.