Binary Oriented Vulnerability Analyzer Based on Hidden Markov Model
Hao Bai, Changzhen Hu, Gang ZHANG, Xiaochuan Jing, Ning Li · IEICE Transactions on Information and Systems · 2010
The letter proposes a novel binary vulnerability analyzer for executable programs that is based on the Hidden Markov Model. A vulnerability instruction library (VIL) is primarily constructed by collecting binary frames located by double precision analysis. Executable programs are then converted into structurized code sequences with the VIL. The code sequences are essentially context-sensitive, which can be modeled by Hidden Markov Model (HMM). Finally, the HMM based vulnerability analyzer is built to recognize potential vulnerabilities of executable programs. Experimental results show the proposed approach achieves lower false positive/negative rate than latest static analyzers.