PMP: Cost-effective Forced Execution with Probabilistic Memory Pre-planning
PMP: Cost-effective Forced Execution with Probabilistic Memory Pre-planning
复制标题
DOI：
10.1109/sp40000.2020.00035
复制
发表时间：
2020-05
期刊：
影响因子：
--
通讯作者：
Wei You;Zhuo Zhang;Yonghwi Kwon;Yousra Aafer;Fei Peng;Yu Shi;C. Harmon;X. Zhang
中科院分区：
文献类型：
--
作者：
Wei You;Zhuo Zhang;Yonghwi Kwon;Yousra Aafer;Fei Peng;Yu Shi;C. Harmon;X. Zhang
恶意软件是一种突出的安全威胁，暴露恶意软件行为是一项关键挑战。最近的恶意软件通常只有在满足某些条件时才会释放有效载荷。因此，很难通过简单地执行恶意软件来完全公开有效载荷。此外，恶意软件样本可能配备有伪装技术，例如一旦检测到恶意软件正在被监视就停止执行的VM检测器。强制执行是一种通过强制设置某些分支结果来穿透恶意软件自我保护并暴露隐藏行为的高效方法。然而，现有的最先进的强制执行技术X-Force是非常重量级的，需要跟踪各个指令，推理指针别名关系的飞行，并修复无效的指针按需分配内存。我们开发了一种轻量级和实用的强制执行技术。在不损失分析精度的情况下，它避免了跟踪单个指令和按需分配。在我们的方案下，强制执行与本地执行非常相似。它具有一个新颖的内存预规划阶段，该阶段预先分配一个大的内存缓冲区，然后在真实的执行之前，以随机方式使用精心制作的值对缓冲区和主题二进制文件中的变量进行优化。预先规划的设计方式是，取消引用无效指针有很大的机会落入预分配区域，因此不会导致任何异常，并且语义不相关的无效指针取消引用很可能访问不相交（预分配）的内存区域，避免状态损坏并具有概率保证。我们的实验表明，我们的技术比X-Force快84倍，程序依赖检测的误报和漏报分别减少6.5倍和10%，并且可以在400个最近的恶意软件样本中暴露98%以上的恶意行为。
Malware is a prominent security threat and exposing malware behavior is a critical challenge. Recent malware often has payload that is only released when certain conditions are satisfied. It is hence difficult to fully disclose the payload by simply executing the malware. In addition, malware samples may be equipped with cloaking techniques such as VM detectors that stop execution once detecting that the malware is being monitored. Forced execution is a highly effective method to penetrate malware self-protection and expose hidden behavior, by forcefully setting certain branch outcomes. However, an existing state-of-the-art forced execution technique X-Force is very heavyweight, requiring tracing individual instructions, reasoning about pointer alias relations on-the-fly, and repairing invalid pointers by on-demand memory allocation. We develop a light-weight and practical forced execution technique. Without losing analysis precision, it avoids tracking individual instructions and on-demand allocation. Under our scheme, a forced execution is very similar to a native one. It features a novel memory pre-planning phase that pre-allocates a large memory buffer, and then initializes the buffer, and variables in the subject binary, with carefully crafted values in a random fashion before the real execution. The pre-planning is designed in such a way that dereferencing an invalid pointer has a very large chance to fall into the pre-allocated region and hence does not cause any exception, and semantically unrelated invalid pointer dereferences highly likely access disjoint (pre-allocated) memory regions, avoiding state corruptions with probabilistic guarantees. Our experiments show that our technique is 84 times faster than X-Force, has 6.5X and 10% fewer false positives and negatives for program dependence detection, respectively, and can expose 98% more malicious behaviors in 400 recent malware samples.