Abstract:Software security analysts typically only have access to the executable program and cannot directly access the source code of the program. This poses significant challenges to security analysis. While it is crucial to identify vulnerabilities in such non-source code programs, there exists a limited set of generalized tools due to the low versatility of current vulnerability mining methods. However, these tools suffer from some shortcomings. In terms of targeted fuzzing, the path searching for target points is not streamlined enough, and the completely random testing leads to an excessively large search space. Additionally, when it comes to code similarity analysis, there are issues with incomplete code feature extraction, which may result in information loss. In this paper, we propose a cross-platform and cross-architecture approach to exploit vulnerabilities using neural network obfuscation techniques. By leveraging the Angr framework, a deobfuscation technique is introduced, along with the adoption of a VEX-IR-based intermediate language conversion method. This combination allows for the unified handling of binary programs across various architectures, compilers, and compilation options. Subsequently, binary programs are processed to extract multi-level spatial features using a combination of a skip-gram model with self-attention mechanism and a bidirectional Long Short-Term Memory (LSTM) network. Finally, the graph embedding network is utilized to evaluate the similarity of program functionalities. Based on these similarity scores, a target function is determined, and symbolic execution is applied to solve the target function. The solved content serves as the initial seed for targeted fuzzing. The binary program is processed by using the de-obfuscation technique and intermediate language transformation method, and then the similarity of program functions is evaluated by using a graph embedding network, and symbolic execution is performed based on these similarity scores. This approach facilitates cross-architecture analysis of executable programs without their source codes and concurrently reduces the risk of symbolic execution path explosion.

VYPER: Vulnerability detection in binary code

Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs

VulCatch: Enhancing Binary Vulnerability Detection through CodeT5 Decompilation and KAN Advanced Feature Extraction

BVDetector: A program slice-based binary code vulnerability intelligent detection system

Towards Vulnerability Discovery Using Staged Program Analysis

Divide and Conquer based Symbolic Vulnerability Detection

BEDetector: A Two-Channel Encoding Method to Detect Vulnerabilities Based on Binary Similarity

Towards Practical Binary Code Similarity Detection: Vulnerability Verification via Patch Semantic Analysis

VulSlicer: Vulnerability detection through code slicing

VCIPR: Vulnerable Code is Identifiable When a Patch is Released (Hacker's Perspective)

Automated software vulnerability detection with machine learning

Binary Program Vulnerability Mining Based on Neural Network

SQVDT: A Scalable Quantitative Vulnerability Detection Technique for Source Code Security Assessment.

DeepVulSeeker: A novel vulnerability identification framework via code graph structure and pre-training mechanism

Recurrent Semantic Learning-driven Fast Binary Vulnerability Detection in Healthcare Cyber Physical Systems

Deep-Learning-based Vulnerability Detection in Binary Executables

VulSniper: Focus Your Attention to Shoot Fine-Grained Vulnerabilities

Vulnerability detection in Java source code using a quantum convolutional neural network with self-attentive pooling, deep sequence, and graph-based hybrid feature extraction

Rampo: A CEGAR-based Integration of Binary Code Analysis and System Falsification for Cyber-Kinetic Vulnerability Detection

SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities

Transformer-based Vulnerability Detection in Code at EditTime: Zero-shot, Few-shot, or Fine-tuning?