Symbol Narrowing for Backdoor Detection in Program Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In analyzing programs for backdoors, existing methods score multiple code blocks, but the presence or absence of access to specific symbols affects the score, leading to many irrelevant symbols being considered, which does not contribute to the increase or decrease of the score depending on the type of backdoor, necessitating a method to narrow down relevant symbols.
Innovation Solution
A symbol narrowing-down apparatus that extracts predetermined symbols from a program's binary, identifies code blocks with specific properties, and selectively narrows down symbols accessed by these blocks based on control flow conditions specific to the type of backdoor being analyzed, excluding irrelevant symbols from the scoring process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all symbols in the program are considered for scoring code blocks, then comprehensive analysis is performed, but the analysis complexity and processing time increase significantly
Solution Approach 1:
The patent segments the set of all symbols into multiple categories based on their relationship with backdoor code blocks. It identifies and extracts only the relevant symbols that are actually accessed by or related to suspicious code blocks, rather than analyzing all symbols in the program. This segmentation reduces the analysis scope while maintaining detection accuracy.
Solution Approach 2:
The patent extracts and isolates the specific symbols that are relevant to backdoor detection from the entire symbol set. By identifying symbols that are accessed by suspicious code blocks or have control flow relationships with them, the system extracts only the necessary subset of symbols for analysis, reducing overall complexity.
2Reliability
If all symbols are included in the scoring process, then no relevant information is missed, but the processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary identification and filtering of relevant symbols before the actual scoring process. By pre-processing the symbol set to remove obviously irrelevant symbols and organizing symbols by their relationship to code blocks, the system prepares the data structure in advance, which speeds up the subsequent scoring operation without compromising detection reliability.
Solution Approach 2:
The patent applies partial action by focusing only on the subset of symbols that are actually relevant to backdoor detection rather than performing exhaustive analysis on all symbols. The system identifies symbols with direct relationships to suspicious code blocks and limits the scoring process to this reduced set, achieving sufficient detection reliability with less processing time.
3Adaptability or versatility
If symbols not related to the specific backdoor type are included in analysis, then all possible backdoor patterns are covered, but the signal-to-noise ratio decreases
Solution Approach 1:
The patent implements a dynamic symbol filtering mechanism that adapts to different backdoor types. Based on the detected or suspected backdoor category, the system dynamically adjusts which symbols are considered relevant and includes them in the scoring process. This dynamic adaptation maintains versatility across different backdoor types while preserving score calculation accuracy by excluding irrelevant symbols for each specific case.
Data Source
AI summary
A symbol narrowing-down apparatus includes a symbol extraction means for extracting a plurality of predetermined symbols from codes included in a binary of a program, a first code block extraction means for extracting a code block having a specific property as a first code block to be analyzed as to whether the code block is a backdoor, a second code block extraction means for extracting, as a plurality of second code blocks, a plurality of code blocks that access the plurality of respective predetermined symbols, a symbol narrowing-down means for extracting, from the plurality of predetermined symbols, a symbol to be accessed by the second code block satisfying a condition on a control flow according to a type of the backdoor to be analyzed among the plurality of second code blocks, and a symbol output means for outputting the symbol extracted by the symbol narrowing-down means.