BinHunt: Automatically Finding Semantic Differences in Binary Programs

Gao, Debin; Reiter, Michael K.; Song, Dawn

doi:10.1007/978-3-540-88625-9_16

Cited by 212 publications

(134 citation statements)

References 9 publications

Supporting

Mentioning

134

Contrasting

Order By: Relevance

“…Based on the matched basic blocks, BinHunt [8] computes the similarity of control flow graphs of two binaries by graph isomorphism; iBinHunt [15] finds semantic differences between execution traces and Luo et al [14] detect software plagiarism by matching "longest common subsequence of semantically equivalent basic blocks".…”

Section: T a R T P A G E R A T I O O F P R O C E S S I N G T I M E ( % )mentioning

confidence: 99%

“…Our efforts attempt to speed up semantics-based binary diffing, which can find equivalent binary pairs that reveal syntactic differences [8,14,15,17]. We have introduced the latest work in this direction in Section 2.…”

Section: Related Workmentioning

confidence: 99%

“…However, such syntax-based comparison can be easily defeated by various obfuscation techniques, such as instruction substitution [9], binary packing [19] and self-modifying code [2]. The latest binary diffing approaches [8,15] simulate semantics of a snippet of binary code (e.g., basic block) by symbolic execution and represent the input-output relations as a set of symbolic formulas. Then the equivalence of formulas are verified by a constraint solver.…”

Section: Introductionmentioning

confidence: 99%

“…Then the equivalence of formulas are verified by a constraint solver. Such logic-based comparison, capturing the intrinsic semantic differences, has been applied to finding differences of program versions [8], comparing inter-procedural control flows [15] and identifying code reuse [14,17].…”

Section: Introductionmentioning

confidence: 99%

“…The core method of current approaches [8,15,14] are matching semantically equivalent basic blocks. Basic block is a straight line code with only one entry point and only one exit point, which makes a basic block highly amenable to symbolic execution (e.g., without conjunction of path conditions).…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Memoized Semantics-Based Binary Diffing with Application to Malware Lineage Inference

Jiang

2015

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

Abstract. Identifying differences between two executable binaries (binary diffing) has compelling security applications, such as software vulnerability exploration, "1-day" exploit generation and software plagiarism detection. Recently, binary diffing based on symbolic execution and constraint solver has been proposed to look for the code pairs with the same semantics, even though they are ostensibly different in syntactics. Such logical-based method captures intrinsic differences of binary code, making it a natural choice to analyze highly-obfuscated malicious program. However, semantics-based binary diffing suffers from significant performance slowdown, hindering it from analyzing large-scale malware samples. In this paper, we attempt to mitigate the high overhead of semantics-based binary diffing with application to malware lineage inference. We first study the key obstacles that contribute to the performance bottleneck. Then we propose basic blocks fast matching to speed up semantics-based binary diffing. We introduce an union-find set structure that records semantically equivalent basic blocks. Managing the union-find structure during successive comparisons allows direct reuse of previously computed results. Moreover, we purpose to concretize symbolic formulas and cache equivalence queries to further cut down the invocation times of constraint solver. We have implemented our technique on top of iBinHunt and evaluated it on 12 malware families with respect to the performance improvement when performing intra-family comparisons. Our experimental results show that our methods can accelerate symbolic execution from 2.8x to 5.3x (with an average 4.0x), and reduce constraint solver invocation by a factor of 3.0x to 6.0x (with an average 4.3x).

show abstract

Section: T a R T P A G E R A T I O O F P R O C E S S I N G T I M E ( % )mentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Memoized Semantics-Based Binary Diffing with Application to Malware Lineage Inference

Jiang

2015

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

show abstract

Multigranularity semantics based vulnerability search method for cross‐platform binary

Líu

Zhang

2021

Int J of Intelligent Sys

View full text Add to dashboard Cite

Semantic learning is a common method for binary vulnerability detection, which can analyze the assembly structure of the binary code. The existing methods such as control flow graphs and labeled semantic flow graphs perform single semantic analysis to determine whether a known vulnerability is hidden in the binary function. However, challenge arises when they perform vulnerability detection cross‐platforms. In this paper, we propose a multigranularity semantic‐based vulnerability search method to deal with the challenge of cross‐platform vulnerability detection, and implement its prototype Taurus. Given the binary function to be searched and vulnerability function, Taurus first extracts their inter‐basic‐block, inter‐function, and inter‐module semantic features respectively, and then calculates the similarity distance between them at three levels. Finally, three similarity scores are combined to rank in descending order to obtain the vulnerability detection report. The performance comparison indicates that Taurus outperforms the state‐of‐the‐art approaches in terms of accuracy.

show abstract

Focus : Function clone identification on cross‐platform

Liu

et al. 2021

Int J of Intelligent Sys

View full text Add to dashboard Cite

Automatic identification of function clones on crossplatform aims at determining whether two functions are identical or not without access to the source code, which is a fundamental challenge in vulnerability search, code plagiarism detection, and malware classification. With the rapid development of deep neural network in pro-K E Y W O R D S attention mechanism, binary similarity, graph neural network, program analysis | INTRODUCTIONBinary code similarity detection is a key foundation in maintaining software security, which can be generally applied in searching critical vulnerability 1 and detecting malware, 2 and so forth. Today, with the booming development of billions of Internet of Things (IoT) devices, the similarity analysis of binary code has become even more important than ever, because (1) code reuse is quite common in IoT which spreads a single vulnerability at source code level across thousands or more embedded devices that have diverse hardware architectures and software platforms 3 and (2) a known vulnerability that has been exploited in the past can also cause unprecedented damage and significant revenue losses to our daily life. 4 Worryingly, accurate and efficient analysis of stripped binary code is difficult because debug information such as symbol names, types, and location of commercial off-the-shelf (COTS) binary is unavailable. Besides, compared to binary code similarity detection on single-platform, function identification on cross-platform needs to deal with the binary code differences caused by various architectures, optimization levels, and compilers, which is even more challenging.Traditional binary code similarity detection approaches 5 adopt symbolic execution, constraint solving, or theorem prover to directly check binary code equivalence. However, these methods are inefficient especially when the number of function pairs is large, making them difficult to be utilized in large-scale applications. Graph matching-based methods use program flow diagrams to represent functions and detect similar functions. [6][7][8][9][10][11] These methods are usually inaccurate or their detection performance is limited by the efficiency of graph matching algorithms. 1,12 For instance, Genius 10 takes more than 1 week to construct their proposed codebook for only three software packages and the time complexity is quadratic in the number of training samples and linear in the cost of the bipartite graph matching algorithm.Recently, with the rapid development of deep learning and graph neural network (GNN), 13,14 graph matching and classification problems such as social network graph analytics 15 and chemical formula matching 13 can be solved well by transforming a representative graph to an embedding.

show abstract

BinHunt: Automatically Finding Semantic Differences in Binary Programs

Cited by 212 publications

References 9 publications

Memoized Semantics-Based Binary Diffing with Application to Malware Lineage Inference

Memoized Semantics-Based Binary Diffing with Application to Malware Lineage Inference

Multigranularity semantics based vulnerability search method for cross‐platform binary

Focus : Function clone identification on cross‐platform

Contact Info

Product

Resources

About