Semantic Learning and Emulation Based Cross-Platform Binary Vulnerability Seeker
Jian Gao, Yu Jiang, Zhe Liu, Xin Yang, Cong Wang, Xun Jiao, Zijiang Yang, Jiaguang Sun · IEEE Transactions on Software Engineering · 2019
Clone detection is widely exploited for software vulnerability search. The approaches based on source code analysis cannot be applied to binary clone detection because the same source code can produce significantly different binaries due to different operating systems, microprocessor architectures and compilers. In this paper, we presentBinSeeker, a cross-platform binary seeker that integrates semantic learning and emulation. With the help of the labeled semantic flow graph,BinSeekercan quickly identify$M$candidate functions that are most similar to the vulnerability from the target binary. The value of$M$is relatively large so this semantic learning procedure essentially eliminates those functions that are very unlikely to have the vulnerability. Then, semantic emulation is conducted on these$M$candidates to obtain their dynamic signature sequences. By comparing signature sequences,BinSeekerproduces top-$N$functions that exhibit most similar behavior to that of the vulnerability. With fast filtering of semantic learning and accurate comparison of semantic emulation,BinSeekerseeks vulnerability precisely with little overhead. The experiments on six widely used programs with fifteen known CVE vulnerabilities demonstrate thatBinSeekeroutperforms three state-of-the-art toolsGenius,GeminiandCACompare. Regarding search accuracy,BinSeekerachieves an MRR value of 0.65 in the target programs, whereas the MRR values byGenius,GeminiandCACompareare 0.17, 0.07 and 0.42, respectively. If we consider ranking a function with the targeted vulnerability in the top-5 as accurate,BinSeekerachieves the accuracy of 93.33 percent, while the accuracy of the other three tools is merely 33.33, 13.33 and 53.33 percent, respectively. Such accuracy is achieved with 0.27s on average to determine whether the target binary function contains a known vulnerability, and the time for the other three tools are 1.57s, 0.15s and 0.98s, respectively. Compared to the time used to manually identify the true positive vulnerability from the false positive candidates reported by Gemini, the time overhead ofBinSeekeris negligible. Evidently, the proposedBinSeekerachieves a better balance between accuracy and efficiency.