基于执行踪迹离线索引的污点分析方法研究

发布时间：2018-11-27 20:51

【摘要】：针对二进制代码的污点分析方法在软件逆向工程、漏洞分析及恶意代码检测等方面具有重大的意义.目前,大多数污点分析方法不支持浮点指令,执行效率较低,且传播的精度也不够高.提出并实现了一种基于执行踪迹离线索引的污点分析方法,以字节为粒度,且支持污点标签.提出执行踪迹离线索引的生成及查询算法,通过离线索引可跳过与污点数据无关的指令,提高污点分析的效率.首次描述并解决了即时翻译执行导致的污点丢失问题.使用污点标签以标识污点的来源和位置.提出较完善的污点传播算法,支持浮点指令,以尽可能精确地刻画污点信息从源操作数传递到目的操作数的过程.实现了灵活的可配置机制,用户可通过黑名单动态地引入污点数据.将提出的方法应用到漏洞检测的场景中,使用12个真实的软件漏洞作为测试样本集,将该方法与TEMU作对比实验,实验结果表明:该方法具备较强的漏洞检测能力,可验证的漏洞数比TEMU更多,且其平均执行效率比TEMU高5倍.
[Abstract]:The stain analysis method for binary code is of great significance in software reverse engineering, vulnerability analysis and malicious code detection. At present, most of the stain analysis methods do not support floating-point instructions, the execution efficiency is low, and the accuracy of propagation is not high enough. In this paper, we propose and implement a stain analysis method based on the execution trace offline index, which takes bytes as the granularity and supports the stain label. An algorithm for generating and querying off-line index is proposed to improve the efficiency of stain analysis by skipping the instructions independent of the stain data. The problem of spot loss caused by instant translation execution is described and solved for the first time. Use a stain label to identify the source and location of the stain. A more perfect stain propagation algorithm is proposed to support floating-point instructions in order to describe the process from source Operand to destination Operand as accurately as possible. A flexible configurable mechanism is implemented, and users can dynamically introduce tainted data through blacklists. The proposed method is applied to the scene of vulnerability detection, and 12 real software vulnerabilities are used as the test sample set. The experimental results show that the method has a strong ability to detect vulnerabilities, and the proposed method is compared with TEMU. There are more verifiable vulnerabilities than TEMU, and the average execution efficiency is 5 times higher than that of TEMU.
【作者单位】：中国信息安全测评中心;北京航空航天大学计算机学院;
【基金】：国家自然科学基金(61502536) 国家高技术研究发展计划(863)(2015AA016004)~~
【分类号】：TP309

【相似文献】