arXivDaily arXiv每日学术速递 周一至周五更新
北美退伍军人节(Veterans Day),12 日无更新
arXiv 1909.01640cs.CRcs.LGcs.PLcs.SC
收藏

通过机器学习和二进制分析静态击败不透明谓词

Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis

Univ. Grenoble Alpes(格勒诺布尔-阿尔卑斯大学);CNRS(法国国家科学研究中心);Institut Fourier(傅里叶研究所);Trusted Labs(Trusted Labs公司);Thales Group(泰雷兹集团)

Ramtine Tofighi-Shirazi, Irina Asăvoae, Philippe Elbaz-Vincent, Thanh-Ha Le

摘要:

我们提出了一种新的方法,桥梁二进制分析技术与机器学习分类的目的是提供一个静态和通用的评价技术不透明的谓词,无论他们的建设。我们使用这种技术作为一个静态的自动去混淆工具,以消除模糊机制引入的不透明谓词。根据我们的实验结果,我们的模型在检测和去混淆最先进的不透明谓词模式方面的准确率高达98%。相比之下,基于符号执行的前沿去混淆方法表现出较低的准确性,主要是由于SMT求解器的约束和缺乏动态符号分析的可扩展性。我们的方法强调了混合符号分析和机器学习技术的静态和通用的去混淆方法的效率。

英文摘要:

We present a new approach that bridges binary analysis techniques with machine learning classification for the purpose of providing a static and generic evaluation technique for opaque predicates, regardless of their constructions. We use this technique as a static automated deobfuscation tool to remove the opaque predicates introduced by obfuscation mechanisms. According to our experimental results, our models have up to 98% accuracy at detecting and deob-fuscating state-of-the-art opaque predicates patterns. By contrast, the leading edge deobfuscation methods based on symbolic execution show less accuracy mostly due to the SMT solvers constraints and the lack of scalability of dynamic symbolic analyses. Our approach underlines the efficiency of hybrid symbolic analysis and machine learning techniques for a static and generic deobfuscation methodology.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑