Automatically generating malicious disks using symbolic execution

Yang, Junfeng; Sar, Can; Twohey, Paul; Cadar, Cristian; Engler, Dawson

doi:10.1109/sp.2006.7

Cited by 43 publications

(2 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[23,24]. Cristian Cadar et al devised a dynamic bug-finding method [5,25,26]. That method is based on the observation that code can generate its own test cases at run-time by a combination of symbolic and concrete execution.…”

Section: Related Workmentioning

confidence: 99%

Scalable Path Search for Automated Test Case Generation

Wang

2022

Electronics

View full text Add to dashboard Cite

Test case generation is an important task during software testing. In this paper, we present a new test-case generation framework for C programs. This approach combines dataflow analysis and dynamic symbolic execution together, and more importantly, it efficiently searches the program path space for potential faults based on the tabu search strategy and the program fault statistics. Unlike the traditional symbolic execution, which explores the program space exhaustively and is difficult to apply to complicated programs effectively, our approach automatically explores the feasible paths of hidden faults with high probability. The scalable and efficient path search strategy facilitates bug finding with much fewer test cases generated. We implemented this approach, and the experimental results presented in this paper are attractive.

show abstract

Section: Related Workmentioning

confidence: 99%

Scalable Path Search for Automated Test Case Generation

Wang

2022

Electronics

View full text Add to dashboard Cite

show abstract

“…Symbolic execution [37] is a technique for finding software bugs in various systems [6,42,60,67,68]. However, symbolic execution suffers from the path explosion problem.…”

Section: Introductionmentioning

confidence: 99%

Eunomia: Enabling User-Specified Fine-Grained Search in Symbolically Executing WebAssembly Binaries

Zhao

Wang

et al. 2023

Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis

View full text Add to dashboard Cite

Although existing techniques have proposed automated approaches to alleviate the path explosion problem of symbolic execution, users still need to optimize symbolic execution by applying various searching strategies carefully. As existing approaches mainly support only coarse-grained global searching strategies, they cannot efficiently traverse through complex code structures. In this paper, we propose Eunomia, a symbolic execution technique that supports fine-grained search with local domain knowledge. Eunomia uses Aes, a DSL that lets users specify local searching strategies for different parts of the program. Eunomia also isolates the context of variables for different local searching strategies, avoiding conflicts. We implement Eunomia for WebAssembly, which can analyze applications written in various languages. Eunomia is the first symbolic execution engine that supports the full features of WebAssembly. We evaluate Eunomia with a microbenchmark suite and six real-world applications. Our evaluation shows that Eunomia improves bug detection by up to three orders of magnitude. We also conduct a user study that shows the benefits of using Aes. Moreover, Eunomia verifies six known bugs and detects two new zero-day bugs in Collections-C. CCS CONCEPTS• Security and privacy → Software security engineering; • Software and its engineering → Software verification and validation.

show abstract

Automatically Identifying Trigger-based Behavior in Malware

Brumley

Hartwig

Liang

et al.

Advances in Information Security

143

122

View full text Add to dashboard Cite

Summary. Malware often contains hidden behavior which is only activated when properly triggered. Well known examples include: the MyDoom worm which DDoS's on particular dates, keyloggers which only log keystrokes for particular sites, and DDoS zombies which are only activated when given the proper command. We call such behavior trigger-based behavior.Currently, trigger-based behavior analysis is often performed in a tedious, manual fashion. Providing even a small amount of assistance would greatly assist and speed-up the analysis. In this chapter, we propose that automatic analysis of trigger-based behavior in malware is possible. In particular, we design an approach for automatic trigger-based behavior detection and analysis using dynamic binary instrumentation and mixed concrete and symbolic execution. Our approach shows that in many cases we can:(1) detect the existence of trigger-based behavior, (2) find the conditions that trigger such hidden behavior, and (3) find inputs that satisfy those conditions, allowing us to observe the triggered malicious behavior in a controlled environment. We have implemented MineSweeper, a system utilizing this approach. In our experiments, MineSweeper has successfully identified trigger-based behavior in real-world malware. Although there are many challenges presented by automatic trigger-based behavior detection, MineSweeper shows us that such automatic analysis is possible and encourages future work in this area.

show abstract

Automatically generating malicious disks using symbolic execution

Abstract: Abstract

Cited by 43 publications

References 27 publications

Scalable Path Search for Automated Test Case Generation

Scalable Path Search for Automated Test Case Generation

Eunomia: Enabling User-Specified Fine-Grained Search in Symbolically Executing WebAssembly Binaries

Automatically Identifying Trigger-based Behavior in Malware

Contact Info

Product

Resources

About