• Journal of KIISE
• /
• v.42 no.6
• /
• pp.713-722
• /
• 2015

As open-source software (OSS) becomes more widely used, many users breach the terms in the license agreement of OSS, or reuse a vulnerable OSS module. Therefore, a technique needs to be developed for investigating if a binary program includes an OSS module. In this paper, we propose an efficient technique to detect a particular OSS module in an executable program using its function-level features. The conventional methods are inappropriate for determining whether a module is contained in a specific program because they usually measure the similarity between whole programs. Our technique determines whether an executable program contains a certain OSS module by extracting features such as its function-level instructions, control flow graph, and the structural attributes of a function from both the program and the module, and comparing the similarity of features. In order to demonstrate the efficiency of the proposed technique, we evaluate it in terms of the size of features, detection accuracy, execution overhead, and resilience to compiler optimizations.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.171-179
• /
• 2022

Self-Modifying-Code is a code that changes the code by itself during execution time. This technique is particularly abused by malicious code to bypass static analysis. Therefor, in order to effectively detect such malicious codes, it is important to identify self-modifying-codes. In the meantime, Self-modify-codes have been analyzed using dynamic analysis methods, but this is time-consuming and costly. If static analysis can detect self-modifying-code it will be of great help to malicious code analysis. In this paper, we propose a static analysis method to detect self-modified code for binary executable programs converted to LLVM IR and apply this method by making a self-modifying-code benchmark. As a result of the experiment in this paper, the designed static analysis method was effective for the standardized LLVM IR program that was compiled and converted to the benchmark program. However, there was a limitation in that it was difficult to detect the self-modifying-code for the unstructured LLVM IR program in which the binary was lifted and transformed. To overcome this, we need an effective way to lift the binary code.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2016.05a
• /
• pp.755-758
• /
• 2016

In this paper, binary in the program function is to be called binary explain the function in any way to call with in the binary. And the functions required during the call to the elements and their dynamic links in the compilation process and its elements and C-language file describes the concept of 'linker' that connects, and static links and dynamic link Compare analysis differences. Also Do an experiment on Return To Dynamic Linker exploit.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.3
• /
• pp.437-444
• /
• 2014

In this paper, we introduce a Graph based Binary Code Execution Path Exploration Platform. In the graph, a node is defined as a conditional branch instruction, and an edge is defined as the other instructions. We implemented prototype of the proposed method and works well on real binary code. Experimental results show proposed method correctly explores execution path of target binary code. We expect our method can help Software Assurance, Secure Programming, and Malware Analysis more correct and efficient.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.5
• /
• pp.1039-1048
• /
• 2019

Symbolic execution, an automatic search method for vulnerability verification, has been technically improved over the last few years. However, it is still not practical to analyze the program using only the symbolic execution itself. One of the biggest reasons is that because of the path explosion problem that occurs during program analysis, there is not enough memory, and you can not find the solution of all paths in the program using symbolic execution. Thus, it is practical for the analyst to construct a path for symbolic execution to a target with vulnerability rather than solving all paths. In this paper, we propose a static analysis - based backward CFG(Control Flow Graph) generation technique that can be used in symbolic execution for program analysis. With the creation of a backward CFG, an analyst can select potential vulnerable points, and the backward path generated from that point can be used for future symbolic execution. We conducted experiments with Linux binaries(x86), and indeed showed that potential vulnerability selection and backward CFG path generation were possible in a variety of binary situations.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2019.10a
• /
• pp.456-458
• /
• 2019

정보보안을 달성하기 위해서 컴퓨터가 보급된 이래로 많은 노력이 이루어졌다. 그중 메모리 보호 기법에 대한 연구가 가장 많이 이루어졌지만, 컴퓨터의 성능 향상으로 이전의 메모리 보호 기법들의 문제들이 발견되고, 부채널 공격의 등장으로 새로운 방어책이 필요 되었다. 본 논문에서는 프로그램에 정적 바이너리 재작성(Static Binary Rewriting) 기법을 통해 페이지(Page)마다 4~8byte 의 난수를 삽입하여 메모리 공유 기반 부채널 공격을 방어할 수 있는 2 가지 방법을 제시한다. 최근 아키텍처는 분기 예측(Branch Prediction)을 통해 jmp 명령어에 대한 분기처리가 매우 빠르고 정확하게 처리되기 때문에 난수를 삽입할 때 사용하는 jmp+rand 방식은 오버헤드가 매우 낮다. 또한 특정 프로그램에만 난수 삽입이 가능하므로 특히 클라우드 환경에서 중복제거 기능과 함께 사용하면 높은 효율성을 보일 수 있다고 예상한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.6
• /
• pp.1331-1345
• /
• 2017

Binary instrumentation has been developed for monitoring and debugging executables without their source codes. Previous efforts on the binary instrumentation are mainly focused on its capability and accuracy, but not on efficiency for practical application. In particular, criteria and measurement methodologies for evaluating and comparing the efficiency of binary investigation tools and algorithms do not estimated yet. In this paper, we propose the instrumentation primitives which are a unit functionality and measurement methodology. Through the empirical experiments by adopting the proposed methodology on DynamoRIO and Pin, we show the feasibility of the proposal.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.16 no.3
• /
• pp.161-166
• /
• 2023

In recent years, new and variant hacking of binary codes has increased, and the limitations of techniques for detecting malicious codes in source programs and defending against attacks are often exposed. Advanced software security vulnerability detection technology using machine learning and deep learning technology for binary code and defense and response capabilities against attacks are required. In this paper, we propose a malware clustering method that groups malware based on the characteristics of the taint information after entering dynamic taint information by tracing the execution path of binary code. Malware vulnerability detection was applied to a three-layered Few-shot learning model, and F1-scores were calculated for each layer's CPU and GPU. We obtained 97~98% performance in the learning process and 80~81% detection performance in the test process.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.04a
• /
• pp.280-282
• /
• 2017

최근 소프트웨어에 내장된 취약점 분석을 위한 자동화 도구 개발 연구가 각 분야에서 활발히 연구되고 있다. 그 중 바이너리 코드를 대상으로 바로 보안취약점을 분석하는 방법이 아닌 중간언어를 활용하여 분석하는 방법이 대두되고 있으며 이를 위한 다양한 중간언어가 제시되었다. 그 중 하이레벨 언어 수준의 내용의 기술이 가능하며 명령어 자체적으로 자료형을 유지하여 보안 취약점 분석에 효과적인 언어로 SIL 중간언어가 재조명 받고 있다. 따라서 본 논문에서는 이룰 위해서 x86/64 기반 어셈블리어를 SIL 로 효과적으로 변환하며 프로그램의 의미가 변하지 않는 것을 확인하기 위해서 프로그램의 제어흐름을 시각화하는 기능을 가진 시스템을 제안한다.

• Journal of the Korea Computer Industry Society
• /
• v.3 no.8
• /
• pp.963-980
• /
• 2002

Software reengineering is making various research for solutions against problem of maintain existing systems. Reengineering has a meaning of development of software on exizting systems through the reverse engineering auf forward engineering. Most of the important concepts used in reengineering is composition that is restructuring of the existing objects. Is there a compiler that can compile a program written in a traditional procedural language (like C or Pascal) and generate a Java bytecode, rather than an executable code that runs oかy on the machine it was compiled (such as an a.out file on a Unix machine)\ulcorner This type of compiler may be very handy for today's computing environment of heterogeneous networks. In this paper we present a software system that does this job at the binary-to-binary level. It takes the compiled binary code of a procedural language and translates it into Java bytecode. To do this, we first translate into an assembler code called Jasmin [7] that is a human-readable representation of Java bytecode. Then the Jasmin assembler converts it into real Java bytecode. The system is not a compiler because it does not start at the source level. We believe this kind of translator is even more useful than a compiler because most of the executable code that is available for sharing does not come with source programs. Of course, it works only if the format of the executable binary code is known. This translation process consists of three major stages: (1) analysis stage that identifies the language constructs in the given binary code, (2) initialization stage where variables and objects are located, classified, and initialized, and (3) mapping stage that maps the given binary code into a Jasmin assembler code that is then converted to Java bytecode.