CRII: SaTC: Towards Paving the Way for Large-Scale Malware Analysis: New Directions in Generic Binary Unpacking

恶意软件，具有危害计算机系统的有害意图，已经成为互联网的重大挑战之一。在丰厚利润的驱使下，恶意软件开发者们不择手段地采用各种混淆方案来规避恶意软件检测。二进制打包是恶意软件作者用来伪装恶意代码和击败流行的基于签名的恶意软件检测的最常见的混淆技术。二进制打包首先将恶意软件代码加密或压缩为数据，使其不受静态分析的影响。在运行时，附加的解包例程将解码后的代码写入内存，然后恢复恶意有效负载执行。在过去的二十年里，打包的恶意软件一直是反恶意软件领域的一个挑战。该项目从新的角度解决了这个问题，并在更好的性能和更强的抗分析能力方面推进了最新技术水平。该项目的新颖之处是新的方法和有效的工具，以提取包装恶意软件的有效载荷，而无需事先了解包装。该项目的影响是为大规模的恶意软件分析铺平了道路，并帮助人们及时响应新兴的恶意软件攻击。现有的通用二进制解包工作遭受高运行时开销和缺乏抗分析能力。该项目对各种恶意软件打包程序进行了深入研究，并揭示了解决长期存在的二进制解包问题的有前途的研究方向。基于调查人员令人鼓舞的初步结果，该项目进一步解决了未解决的挑战，并为完整的通用拆包解决方案铺平了最后一英里。该项目开发了一种新的机器学习模型来提取原始入口点的语义。所提出的技术明显优于现有的搜索算法。该项目的混合去混淆方法使解包工具能够恢复原始二进制文件的全功能版本，这是解包技术的最终目标。为了实现对各种反分析攻击的更强的弹性，研究者使用硬件支持的低级功能来检测解包的结束。 该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Malware, with harmful intent to compromise computer systems, has been one of the significant challenges to the Internet. Driven by the rich profit, relentless malware developers apply various obfuscation schemes to circumvent malware detection. Binary packing is the most common obfuscation adopted by malware authors to camouflage malicious code and defeat popular signature-based malware detection. Binary packing first encrypts or compresses malware code as data, making it immune to static analysis. At run time, the attached unpacking routine writes the decoded code to memory and then resumes malicious payload execution. Over the past two decades, packed malware has been a challenge in the anti-malware landscape. This project addresses this problem from new angles and advances the state of the art in terms of better performance and stronger anti-analysis resistance. The project's novelties are new methods and efficient tools to extract packed malware payload without the prior knowledge of packers. The project's impacts are paving the way for large-scale malware analysis and helping people respond to emerging malware attacks promptly.Existing generic binary unpacking work suffers from high runtime overhead and lack of anti-analysis resistance. This project conducts an in-depth study on an enormous variety of malware packers and reveals promising research directions to address the long-standing binary unpacking problem. Based on the investigator's encouraging preliminary results, this project goes one step further to address the unsolved challenges and pave the last mile to a complete generic unpacking solution. This project develops a novel machine learning model to extract the semantics of the original entry point. The proposed technique notably outperforms existing search heuristics. This project's hybrid de-obfuscation approaches enable unpacking tools to recover a fully functional version of the original binary, which is the ultimate goal of unpacking technique. To achieve stronger resilience to various anti-analysis attacks, the investigator advances the use of hardware supported lower-level features to detecting the end of unpacking. The proposed methods can handle a broader range of malware packers, even brand new packers.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.