Abstract:As control-flow protection gets widely deployed, it is difficult for attackers to corrupt control-data and achieve control-flow hijacking. Instead, data-oriented attacks, which manipulate non-control data, have been demonstrated to be feasible and powerful. In data-oriented attacks, a fundamental step is to identify non-control, security-critical data. However, critical data identification processes are not scalable in previous works, because they mainly rely on tedious human efforts to identify critical data. To address this issue, we propose a novel approach that combines traditional program analysis with deep learning. At a higher level, by examining how analysts identify critical data, we first propose dynamic analysis algorithms to identify the program semantics (and features) that are correlated with the impact of a critical data. Then, motivated by the unique challenges in the critical data identification task, we formalize the distinguishing features and use customized program dependence graphs (PDG) to embed the features. Different from previous works using deep learning to learn basic program semantics, this paper adopts a special neural network architecture that can capture the long dependency paths (in the PDG), through which a critical variable propagates its impact. We have implemented a fully-automatic toolchain and conducted comprehensive evaluations. According to the evaluations, our model can achieve 90% accuracy. The toolchain uncovers 80 potential critical variables in Google FuzzBench. In addition, we demonstrate the harmfulness of the exploits using the identified critical variables by simulating 7 data-oriented attacks through GDB.

Data flow analysis for C program based on graph model

Static Information Flow Tracking Based Approach to Detect Input Validation Vulnerabilities

Dependence Analysis for C Programs with Combinability of Dataflow Facts under Consideration

An efficient control flow security analysis approach for binary executables

A method for hidden malcode anomaly detection using dynamic control-flow analysis

Necessity and Capability of Flow, Context, Field and Quasi Path Sensitive Points-to Analysis

Data-Flow Based Model Analysis and Its Applications

Malware Detection Based on Critical Application Programming Interface Graph

Program Intrusion Detection Based on Simplified Control Flow Monitoring

Catamorphic Approach to Program Analysis

Identifying Non-Control Security-Critical Data through Program Dependence Learning

Static Detection of Control-Flow-Related Vulnerabilities Using Graph Embedding

Continuous Flow Analysis to Detect Security Problems

Iterative-free Program Analysis

Modeling and Analysis Method Based on Multi-Signal Flow Graph Using Multi-Functional Fault Model

Coarse-grained Dynamic Taint Analysis for Defeating Control and Non-control Data Attacks

GraphEye: A Novel Solution for Detecting Vulnerable Functions Based on Graph Attention Network

Efficient And Practical Control Flow Monitoring For Program Security

A Variable Value Range Analysis Method Based on Path Propagation.

An Integration of Several Different Data Flow Analysis Techniques

Fine Grained Dataflow Tracking with Proximal Gradients