Efficient Features for Function Matching in Multi-Architecture Binary Executables
DC Field | Value | Language |
---|---|---|
dc.contributor.author | Ullah, Sami | - |
dc.contributor.author | Jin, Wenhui | - |
dc.contributor.author | Oh, Heekuck | - |
dc.date.accessioned | 2023-12-11T08:00:22Z | - |
dc.date.available | 2023-12-11T08:00:22Z | - |
dc.date.issued | 2021-08 | - |
dc.identifier.issn | 2169-3536 | - |
dc.identifier.uri | https://scholarworks.bwise.kr/erica/handle/2021.sw.erica/116254 | - |
dc.description.abstract | Binary-binary function matching problem serves as a plinth in many reverse engineering techniques such as binary diffing, malware analysis, and code plagiarism detection. In literature, function matching is performed by first extracting function features (syntactic and semantic), and later these features are used as selection criteria to formulate an approximate 1:1 correspondence between binary functions. The accuracy of the approximation is dependent on the selection of efficient features. Although substantial research has been conducted on this topic, we have explored two major drawbacks in previous research. (i) The features are optimized only for a single architecture and their matching efficiency drops for other architectures. (ii) function matching algorithms mainly focus on the structural properties of a function, which are not inherently resilient against compiler optimizations. To resolve the architecture dependency and compiler optimizations, we benefit from the intermediate representation (IR) of function assembly and propose a set of syntactic and semantic (embedding-based) features which are efficient for multi-architectures, and sensitive to compiler-based optimizations. The proposed function matching algorithm employs one-shot encoding that is flexible to small changes and uses a KNN based approach to effectively map similar functions. We have evaluated proposed features and algorithms using various binaries, which were compiled for x86 and ARM architectures; and the prototype implementation is compared with Diaphora (an industry-standard tool), and other baseline research. Our proposed prototype has achieved a matching accuracy of approx. 96%, which is higher than the compared tools and consistent against optimizations and multi-architecture binaries. | - |
dc.format.extent | 19 | - |
dc.language | 영어 | - |
dc.language.iso | ENG | - |
dc.publisher | Institute of Electrical and Electronics Engineers Inc. | - |
dc.title | Efficient Features for Function Matching in Multi-Architecture Binary Executables | - |
dc.type | Article | - |
dc.publisher.location | 미국 | - |
dc.identifier.doi | 10.1109/ACCESS.2021.3099429 | - |
dc.identifier.scopusid | 2-s2.0-85111929749 | - |
dc.identifier.wosid | 000679517100001 | - |
dc.identifier.bibliographicCitation | IEEE Access, v.9, pp 104950 - 104968 | - |
dc.citation.title | IEEE Access | - |
dc.citation.volume | 9 | - |
dc.citation.startPage | 104950 | - |
dc.citation.endPage | 104968 | - |
dc.type.docType | Article | - |
dc.description.isOpenAccess | Y | - |
dc.description.journalRegisteredClass | scie | - |
dc.description.journalRegisteredClass | scopus | - |
dc.relation.journalResearchArea | Computer Science | - |
dc.relation.journalResearchArea | Engineering | - |
dc.relation.journalResearchArea | Telecommunications | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Information Systems | - |
dc.relation.journalWebOfScienceCategory | Engineering, Electrical & Electronic | - |
dc.relation.journalWebOfScienceCategory | Telecommunications | - |
dc.subject.keywordPlus | CODE | - |
dc.subject.keywordAuthor | Feature extraction | - |
dc.subject.keywordAuthor | Semantics | - |
dc.subject.keywordAuthor | Optimization | - |
dc.subject.keywordAuthor | Tools | - |
dc.subject.keywordAuthor | Syntactics | - |
dc.subject.keywordAuthor | Malware | - |
dc.subject.keywordAuthor | Computer architecture | - |
dc.subject.keywordAuthor | Binary diffing | - |
dc.subject.keywordAuthor | efficient features | - |
dc.subject.keywordAuthor | function matching | - |
dc.subject.keywordAuthor | multi-architecture | - |
dc.identifier.url | https://www.scopus.com/record/display.uri?eid=2-s2.0-85111929749&origin=inward&txGid=5d7ef9a192a57c5a6a812bd14b94ba3f | - |
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.
55 Hanyangdeahak-ro, Sangnok-gu, Ansan, Gyeonggi-do, 15588, Korea+82-31-400-4269 sweetbrain@hanyang.ac.kr
COPYRIGHT © 2021 HANYANG UNIVERSITY. ALL RIGHTS RESERVED.
Certain data included herein are derived from the © Web of Science of Clarivate Analytics. All rights reserved.
You may not copy or re-distribute this material in whole or in part without the prior written consent of Clarivate Analytics.