SaTC: CORE: Small: Semantics-Oriented Binary Code Analysis Learning from Recent Advances in Deep Learning

对于封闭源代码的程序，如大多数专有软件和病毒，二进制代码分析对于各种任务是必不可少的，如漏洞发现和恶意软件分析。一些分析技术可以很好地扩展，但不能准确地捕获程序语义，而另一些分析技术更准确，但在可伸缩性方面受到限制。如何同时提高二进制代码分析的准确性和可扩展性是一个有趣的悬而未决的问题。本研究的目的是基于深度学习的最新进展，建立新的二进制代码分析方法和技术，以实现高精度和可伸缩性。该项目不仅将推进跨体系结构的二进制代码分析，还将推动其在漏洞发现、抄袭检测和恶意软件理解方面的应用，特别是在异构物联网设备的背景下。该项目的教育资源将通过一个专门的网站传播。这项研究将在南卡罗来纳大学培养新的研究和教育机会。本尼迪克特学院(HBCU)学生参与研究的推广和教育活动将扩大未被充分代表的群体参与计算机安全研究的范围。本研究强调面向代码语义的学习，以自下而上的方法构建基于深度学习的代码分析，旨在逐层从二进制代码中提取语义信息。该项目的技术目标分为三个方面。首先，受神经机器翻译的启发，指令和基本块被表示为嵌入(即高维向量)，就像NMT将词和句子表示为高维空间中的点一样，以便于进一步处理。其次，使用在指令层和基本块层捕获的代码语义在控制流图级别进行分析。分层学习过程符合代码中固有的语义层次结构，从指令、基本块到控制流程图。因此，它最大限度地减少了语义信息的损失，并保持了可伸缩性。第三，是否以及如何将拟议的技术扩展到处理某些模糊处理将被调查。这一裁决反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Given a closed-source program, such as most of proprietary software and viruses, binary code analysis is indispensable for various tasks, such as vulnerability discovery and malware analysis. Some analysis techniques scale well but cannot accurately capture the program semantics, while others are more accurate but limited in scalability. How to improve both the accuracy and scalability of binary code analysis is an intriguing unresolved problem. The objective of this research is to build novel binary code analysis approaches and techniques based on recent advances in deep learning to achieve both high accuracy and scalability. This project will not only advance cross-architecture binary code analysis, but also propel its applications in vulnerability discovery, plagiarism detection, and malware understanding, especially in the context of heterogeneous IoT devices. Educational resources from this project will be disseminated through a dedicated web site. This research will foster new research and education opportunities at University of South Carolina. The outreach and educational activities that engage students from Benedict College (HBCU) in the research will broaden the participation of underrepresented groups in computer security research.This research emphasizes code semantics-oriented learning by building deep learning based code analysis in a bottom-up approach, aiming to extract semantic information from binary code layer by layer. The technical aims of the project are divided into three thrusts. First, inspired by Neural Machine Translation, instructions and basic blocks are represented as embeddings (i.e., high-dimensional vectors), just like NMT represents words and sentences as points in high-dimensional spaces to facilitate further handling. Second, the captured code semantics at the instruction and basic-block layers are used for analysis at the control flow graph level. The layered learning process fits the hierarchy of semantics inherent in code from instructions, basic blocks, to control flow graphs. Thus, it minimizes the loss of semantic information and keeps scalable. Third, whether and how the proposed techniques can be extended to handle certain obfuscations will be investigated.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.