Firmware binary code analysis for vulnerability detection

物联网（IoT）由各种设备组成，从微型传感器和执行器到驱动水、电等关键基础设施的可编程控制器，再到家庭、工作或城市环境中的通用移动设备。无论设备的类型如何，软件代码，即所谓的固件，仍然是所有设备的共同组成部分，而且（据说）认为这些代码不会经常更新，从而永远留下代码中的漏洞。拥有这样一个异构计算环境的一个副作用是在这样一组不同的设备上运行各种各样的“编译”代码。这对开发自动程序分析技术来处理语法上看起来不同的代码提出了挑战。过去的研究表明，漏洞外推是一种可能性，例如，通过系统地比较二进制代码来找到导致脆弱代码的模式。在这个项目中，我们的目标是研究通过剥离语法差异来分析二进制代码的技术。该项目在某种意义上是开放的，人们可以研究静态和动态程序分析技术，例如抽象解释，模糊等。特别侧重于研究基于机器学习（ML）的方法的应用，例如，自然语言处理（NLP），以找到类似的代码模式。众所周知，基于nlp的技术可以处理语法结构非常不同的语言。一个特别的方面是将编译代码的基于汇编代码的表示映射为适合应用NLP的形式。简而言之，该项目将允许人们探索分析二进制代码的技术

Internet of Things (IoT) constitutes a variety of devices, ranging from tiny sensors and actuators to programmable controllers that drive critical infrastructure such as water, power, through to general purpose mobile devices in the home, work, or city environment. Irrespective of the type of a device, software code, the so-called firmware, remains a common component across all of them and it is (anecdotally) believed that such code is not updated frequently, thereby leaving bugs in code forever. A side effect of having such a heterogeneous computing environment is the variety of "compiled" code running on such a diverse set of devices. This poses a challenge for developing automatic program analysis techniques to cope with the syntactically different looking code. Past research has shown that vulnerability extrapolation is a possibility, for example, through approaches to systematically compare binary code to find patterns leading to vulnerable code. In this project, we aim to investigate techniques that are tailored towards analysing binary code by stripping off syntactical differences. The project is open in the sense that one can investigate static as well as dynamic program analysis techniques, for example abstract interpretation, fuzzing etc. There is a particular focus on investigating the application of machine learning (ML) based approaches, e.g., natural language processing (NLP), to find similar code patterns. NLP-based techniques are known to work with languages with very different syntactical structure. One particular aspect is to map assembly code-based representation of compiled code in a form suitable for applying NLP. In short, the project will allow one to explore techniques to analyse binary code