CAREER: Advanced Trace-Oriented Binary Code Analysis

从安全的角度来看，二进制码分析非常有吸引力。首先，在恶意软件分析等许多任务中，被检查程序的源代码往往是缺席的，必须对二进制代码进行分析。其次，即使源代码是可用的，二进制分析也允许我们对在硬件上执行的真实指令进行推理，并避免众所周知的WYSINWYX问题，您看到的不是您执行的。第三，一些程序行为，如缓存访问模式，只在低级代码中表现出来。另一方面，二进制代码分析面临着由新兴的、随时可用的代码混淆技术所带来的日益增长的挑战。传统的基于签名的恶意软件检测往往存在问题，因为它依赖于文件哈希和字节(或指令)签名，这些签名对混淆的恢复能力不是很强。该项目通过提出几种从行为和语义角度结合技术的高级方法来解决这一挑战。提出了系统调用分片段等价检查和N元语法基本块语义记忆两个新概念，以达到更好的混淆弹性和可扩展性。与已有的方法相比，这些方法基于强大的程序语义和逻辑原理，对自动混淆方案具有更强的弹性，并与所提出的高级语义记忆技术相结合，具有更强的可扩展性。此外，通过一种新的严格模型，将其应用扩展到了旁路检测。该项目完成后，将对总体上的二进制代码分析做出重大贡献。它将推动恶意软件分析和旁路检测的最先进水平，并帮助更好地防御网络攻击，导致更安全的网络空间。教育和传播倡议也将产生更广泛的影响。

Binary code analysis is very attractive from a security viewpoint. First, in many tasks such as malware analysis, the source code of the program under examination is often absent, and the analysis has to be done on binary code. Second, even the source code is available, binary analysis allows us to reason about the real instructions executed on hardware and avoid the well-known WYSINWYX problem, What You See Is Not What You Execute. Third, some program behaviors, such as cache access patterns, are only exhibited in the low-level code. On the other hand, binary code analysis is faced with an increasing challenge caused by the emerging, readily available code obfuscation techniques. Traditional signature-based malware detection is often problematic as it relies on file hashes and byte (or instruction) signatures which are not very resilient to obfuscation.This project tackles the challenge by proposing several advanced methods that combine techniques from the behavior and semantics perspectives. Two new concepts, System Call Sliced Segment Equivalence Checking and N-gram Basic Block Semantics Memoization, are proposed to achieve better obfuscation resiliency and scalability. Compared with the existing approaches, these methods are based on the strong principles of program semantics and logics, more resilient to automatic obfuscation schemes, and more scalable with the proposed advanced semantics memoization techniques. In addition, the application is extended to side-channel detection with a new rigorous model. Upon completion, the project will make a significant contribution to binary code analysis in general. It will advance the state of the art of malware analysis and side-channel detection and help better defend cyber attacks, leading to more secure cyber space. Broader impact will also result from the education and dissemination initiatives.