BinProv: Binary Code Provenance Identification without Disassembly

He, Xu; Wang, Shu; Xing, Yunlong; Feng, Pengbin; Wang, Haining; Li, Qi; Chen, Songqing; Sun, Kun

doi:10.1145/3545948.3545956

Cited by 12 publications

(12 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Therefore, the classification performance of our method when the machine code is compressed or obfuscated is unknown. Experiments have confirmed that BinProv performs well for simple obfuscations such as instruction substitution [6]. However, they claim that multiple obfuscations are very difficult to classify, and our method is expected to be very difficult as well.…”

Section: Limitationmentioning

confidence: 63%

“…As a result, they confirmed that the classification performance is better with raw byte strings than with encoded input data, provided that the input data is of a certain length. Their experimental results show the possibility of supporting multiple CPU architectures simultaneously by using raw input data, which is demonstrated by BinProv [6], described next.…”

Section: B Compiler Provenace Recovery For Multi-cpu Architecturementioning

confidence: 95%

“…Since the aggregation process is a simple majority vote, the classification accuracy from a single file The best result is indicated in bold. The experimental results of BinProv are quoted from the paper [6].…”

Section: ) Ex 6: Multi-cpu Architecturementioning

confidence: 99%

“…For the analysis of file fragments recovered by digital forensics, we need a BSR method that takes a raw input bitstream and enables highly accurate class classification while simultaneously addressing various domains without any preprocessing. However, there are still only a few studies that use raw bitstreams as training data and has high classification accuracy while simultaneously addressing various domains [6]. CPR is mainly a classification for machine language instruction sequences.…”

Section: Introductionmentioning

confidence: 99%

“…It is also known that, in general, losses in natural language processing models decrease as the size of the model, the size of the data set, and the computational power used for training increase [10]. In CPR, there has been a trend toward the giant size of models, as seen in the publication of a method using RoBERTa [6]. On the other hand, there are issues such as increasing the size of the data set for training in accordance with the model size increase, and the increase in the computational cost of training limits the fields in which it can be applied.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Compiler Provenance Recovery for Multi-CPU Architectures Using a Centrifuge Mechanism

Otsubo,

Otsuka,

Mimura

2024

IEEE Access

View full text Add to dashboard Cite

Bit-stream recognition (BSR) has a wide range of applications, including forensic investigations, detecting copyright infringement, and analyzing malware. In order to analyze file fragments recovered by digital forensics, it is necessary to use a BSR method that can accurately classify classes while addressing various domains without preprocessing the raw input bitstream. For example, it is important to note that in the case of compiler provenance recovery, a type of BSR, the same bit sequence can have different meanings for different CPU architectures. As a result, traditional methods that rely heavily on disassembly tools, such as IDA Pro, may have limited in applicaballity scope to programs designed for specific CPU architecture. To address the aforementioned limitation, we proposed a novel learning method. Our method involves the upstream layers (sub-net) capturing global features and instructing the downstream layers (main-net) to shift focus, even when a portion of the input bit-stream has identical values. Through our experiments, we utilized a model that was less than 1/300 the size of the state-of-the-art model. Despite its smaller size, our method achieved the highest classification performance of 99.54 on a multi-CPU architecture, outperforming existing methods.

show abstract

Section: Limitationmentioning

confidence: 63%

Section: B Compiler Provenace Recovery For Multi-cpu Architecturementioning

confidence: 95%

Section: ) Ex 6: Multi-cpu Architecturementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations