Source Binary Code Correspondence Auditor
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security-sensitive organizations face challenges in ensuring the trustworthiness of software products, as the number of contributors increases the risk of malicious code being introduced during software development, requiring both source and binary code audits to verify the absence of backdoors and malicious functionality.
Innovation Solution
A code auditor system that compares features between source and binary code to classify functions as accountable or unaccountable, using machine learning to differentiate between compiler optimizations and potential backdoors, thereby reducing the manual effort required for binary audits by identifying functions that can be trusted as safe.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple parties contribute to software product development, then the software integrates diverse functionality and perspectives, but the trustworthiness decreases due to increased risk of malicious code introduction
Solution Approach 1:
The patent segments the software auditing process into source code auditing and binary code auditing phases. By dividing the verification process into distinct stages with different analysis methods, the system can leverage the strengths of each approach while maintaining comprehensive security verification across multi-party contributions.
Solution Approach 2:
The patent introduces an automated auditing system as an intermediary between multiple software contributors and the final software product. This intermediary performs systematic analysis of both source and binary code to verify trustworthiness, acting as an objective mediator that can handle the complexity of multi-party verification.
2Reliability
If both source code audit and binary code audit are performed, then the trustworthiness verification is comprehensive, but the manual effort and time required increase significantly
Solution Approach 1:
The patent performs source code auditing as a preliminary action before binary code auditing. By analyzing the source code first to establish expected functionality and structure, the system creates a reference framework that guides the subsequent binary analysis, reducing the time needed for comprehensive verification.
Solution Approach 2:
The patent implements feedback mechanisms where results from source code auditing inform the binary code auditing process. The system uses information from the first audit phase to guide and optimize the second phase, creating a feedback loop that reduces redundant analysis and overall auditing time.
3Productivity
If automated feature extraction and comparison is used to match source code and binary code functions, then the auditing efficiency improves, but the complexity of the matching algorithm increases
Solution Approach 1:
The patent extracts specific features from both source code and binary code representations to enable comparison. By selecting and extracting only the most relevant features (such as function signatures, control flow characteristics, and data flow patterns) rather than analyzing complete code sets, the system improves efficiency while managing algorithmic complexity.
Solution Approach 2:
The patent applies different analysis methods and feature extraction techniques to different parts of the code based on their specific characteristics. Rather than using a uniform complex algorithm throughout, the system adapts its matching approach to local code structures, simplifying the overall system while maintaining high efficiency.
Data Source
AI summary
A first set of code, for example source code, and a second code, for example binary code, are compared to find corresponding functions. A comparison of features can be used to find correspondences of functions. The comparison of functions can be iterated and can be refined and can be further used to carry out a further, stricter comparison of functions found to correspond to reduce the chance of falsely finding a function in the second code to be accountable in the first code.