SaTC: CORE: Small: Towards Robust and Scalable Search of Binary Code and Data

二进制编码和数据搜索的问题涉及如何以准确、可扩展和健壮的方式从二进制编码和二进制数据中收集有价值的信息。这是许多安全问题的核心，包括漏洞扫描、代码抄袭检测、软件谱系、恶意软件分类、内存取证、虚拟机自省、恶意文档检测等。虽然这个问题并不新鲜，已经提出了大量的解决方案，但没有一个解决方案能够同时达到准确性、可扩展性和健壮性的要求。由于搜索方案的不同，二进制代码和数据搜索存在瓶颈：二进制代码搜索的配对比较不具有伸缩性，基于规则的二进制数据搜索过于僵化，因此对不同平台版本和恶意操作造成的更改不具有健壮性。主要有两个研究方向：1)可扩展的跨平台二进制代码搜索，旨在通过聚类和深度学习从二进制代码中自动学习高级特征，从不同体系结构的大型二进制代码库中快速识别语义等价或相似的代码；2)自适应、高效和健壮的二进制数据分析，旨在通过构建深度神经网络模型，从内存转储和文档等二进制数据中准确识别对象。由于二进制代码和数据搜索是许多安全应用程序的基础，因此对这些基础的改进可以推动构建在其上的所有安全应用程序的边界。此外，深度学习在二进制代码和数据搜索中的成功应用将彻底改变我们如何从总体上解决许多安全问题，并通过深度学习刺激更多关于安全方向的研究。

The problem of binary code and data search concerns how to glean valuable information from binary code and binary data in an accurate, scalable and robust fashion. This concern is central to many security problems, including vulnerability scanning, code plagiarism detection, software lineage, malware classification, memory forensics, virtual machine introspection, malicious document detection, etc. Although this problem is not new and a great deal of solutions have been proposed, no solutions can achieve the requirements of accuracy, scalability and robustness simultaneously. There are bottlenecks for binary code and data search due to the search schemes: pair-wise comparison for binary code search does not scale, and rule-based binary data search is too rigid and thus not robust against changes caused by different platform versions and malicious manipulations.The proposed work takes a novel approach to the problem of binary code and data search, one that mimics how the human brain recognizes interesting objects from an enormous amount of visual information. There are two research thrusts: 1) scalable cross-platform binary code search, which aims to quickly identify semantically equivalent or similar code from a large binary code base in different architectures, by automatically learning high-level features from binary code via clustering and deep learning; and 2) adaptive, efficient and robust binary data analysis, which aims to accurately identify objects from binary data such as memory dumps and documents, by constructing deep neural network models. Because binary code and data search are foundational for many security applications, advances to these foundations can push the boundary for all the security applications built on top. Moreover, successful application of deep learning onto binary code and data search will revolutionize how we solve many security problems in general and stimulate more research in the direction of security by deep learning.