Using the Strings Metadata to Detect the Source Language of the Binary

Adhikari, Ashish; Kulkarni, Prasad A.

doi:10.1007/978-3-031-14054-9_19

Cited by 2 publications

(1 citation statement)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Programming Language Inference. Adhikari et al [52] focuses on detecting a programming language itself with string metadata from binaries such as Swift, Rust, C/C++, Go, and Fortran, which differs from our goal to identify a compiler toolchain.…”

Section: Related Workmentioning

confidence: 99%

ToolPhet: Inference of Compiler Provenance From Stripped Binaries With Emerging Compilation Toolchains

Jang,

Murodova,

Koo

2024

IEEE Access

View full text Add to dashboard Cite

Identifying compiler toolchain provenance serves as a basis for both benign and malicious binary analyses. A wealth of prior studies mostly focuses on the inference of a popular compiler toolchain for C and C++ languages from stripped binaries that are built with GCC or clang. Lately, the popularity of an emerging compiler is on the rise such as Rust, Go, and Nim programming languages that complement the downsides of C and C++ (e.g., security), which little has been explored on them. The main challenge arises when applying previous inference techniques for toolchain provenance because some emerging compilation toolchains adopt the same backend of traditional compilers. In this paper, we propose ToolPhet, an effective end-to-end BERT-based system for deducing the provenance of both traditional and emerging compiler toolchains. To this end, we thoroughly study the characteristics of both an emerging toolchain and an executable binary that is generated by that toolchain. We introduce two separate downstream tasks for the compiler toolchain inference with a (BERT-based) fine-tuning process, which produces i) a toolchain classification model, and ii) a binary code similarity detection model. Our findings show that the classification model (i) may not suffice when producing a binary with the existing backend like Nim, which we adopt the detection model (ii) that can infer underlying code semantics. We evaluate ToolPhet with the previous work including one signature-based tool and four machine-learning-based approaches, demonstrating its effectiveness by achieving higher F1 scores with the binaries compiled with emerging compilation toolchains.

show abstract

Section: Related Workmentioning

confidence: 99%