{"id":2565,"date":"2018-06-25T07:20:11","date_gmt":"2018-06-25T07:20:11","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=2565"},"modified":"2018-06-25T07:20:21","modified_gmt":"2018-06-25T07:20:21","slug":"%e3%80%90%e6%b4%bb%e5%8a%a8%e9%a2%84%e5%91%8a%e3%80%916%e6%9c%8827%e6%97%a5%e8%bd%af%e4%bb%b6%e6%99%ba%e8%83%bd%e5%88%86%e6%9e%90%e5%ad%a6%e6%9c%af%e6%b2%99%e9%be%99%e7%ac%ac","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=2565","title":{"rendered":"\u3010\u6d3b\u52a8\u9884\u544a\u30116\u670827\u65e5\u201c\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u201d\u5b66\u672f\u6c99\u9f99\u7b2c\u516d\u6b21\u6d3b\u52a8\u7b49\u4f60\u6765\u53c2\u4e0e"},"content":{"rendered":"

\u201c\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u201d\u5b66\u672f\u6c99\u9f99\u7b2c\u516d\u6b21\u6d3b\u52a8\u5c06\u4e8e2018\u5e746\u670827\u65e5\uff08\u661f\u671f\u4e09\u4e0a\u5348\uff099\u70b9\u5728\u4e2d\u56fd\u79d1\u5b66\u9662\u8f6f\u4ef6\u7814\u7a76\u62405\u53f7\u697c\u56db\u5c42\u7b2c\u4e00\u4f1a\u8bae\u5ba4\u4e3e\u884c\u3002\u672c\u6b21\u6d3b\u52a8\u7531\u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u534f\u540c\u521b\u65b0\u56e2\u961f\u548cInForSec\u8bba\u575b\u5171\u540c\u4e3e\u529e\uff0c\u9080\u8bf7\u5230\u4e86\u65b0\u52a0\u5761\u56fd\u7acb\u5927\u5b66\u7684\u6881\u632f\u51ef\u6559\u6388\uff0cChua Zheng Leong\u535a\u58eb\uff0c\u4e24\u4f4d\u5b66\u8005\u5c06\u5206\u522b\u5e26\u6765AI\u5728\u4e8c\u8fdb\u5236\u7a0b\u5e8f\u5206\u6790\u5de5\u4f5c\u4e2d\u5e94\u7528\u7684\u6700\u65b0\u7814\u7a76\u6210\u679c\u3002\u656c\u8bf7\u5173\u6ce8\u3002<\/p>\n

\u4e3b\u529e\uff1a\u4e2d\u56fd\u79d1\u5b66\u9662\u8f6f\u4ef6\u7814\u7a76\u6240\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u534f\u540c\u521b\u65b0\u56e2\u961f<\/strong><\/p>\n

\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0InForSec\u7f51\u5b89\u56fd\u9645\u5b66\u672f\u8bba\u575b<\/strong><\/p>\n

\u65f6\u95f4\uff1a2018\u5e746\u670827\u65e5\uff08\u5468\u4e09\uff09\u4e0a\u53489:00-11:30<\/strong><\/p>\n

\u5730\u70b9\uff1a\u4e2d\u56fd\u79d1\u5b66\u9662\u8f6f\u4ef6\u7814\u7a76\u62405\u53f7\u697c\u56db\u5c42\u7b2c\u4e00\u4f1a\u8bae\u5ba4<\/strong><\/p>\n

\u00a0\u4f1a\u8bae\u8bae\u7a0b<\/strong><\/p>\n\n\n\n\n\n\n
\u4e8b\u9879<\/b><\/strong><\/td>\n\u4e3b\u8bb2\u5609\u5bbe<\/b><\/strong><\/td>\n\u4e3b\u9898<\/b><\/strong><\/td>\n<\/tr>\n
9:00 \u00a0\u2013 11:30<\/td>\n\u4e3b\u6301\u4eba\uff1a\u82cf\u749e\u777f\u00a0\u00a0\u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240\u7814\u7a76\u5458<\/td>\n<\/tr>\n
9:00 \u00a0\u2013 10:00<\/td>\n\u4e13\u5bb6\u62a5\u544a<\/td>\n\u6881\u632f\u51ef<\/td>\nScaling up Binary Analysis through Knowledge-oriented Techniques<\/td>\n<\/tr>\n
10:10 \u00a0\u2013 11:10<\/td>\n\u4e13\u5bb6\u62a5\u544a<\/td>\nChua Zheng Leong<\/td>\nNeural Nets Can Learn Function\u00a0 Type Signatures From Binaries<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u6f14\u8bb2\u5609\u5bbe<\/strong><\/p>\n

\u9898\u76ee\uff1aScaling up Binary Analysis through Knowledge-oriented Techniques<\/strong><\/p>\n

\"\"<\/a><\/p>\n

\u8bb2\u8005\uff1a\u6881\u632f\u51ef \u526f\u6559\u6388<\/strong><\/p>\n

\u6458\u8981\uff1aBinary analysis is a fundamental technique in software and system security. It has a wide range of applications, such as vulnerability discovery, attack response, malware analysis, and software testing and debugging. Due to the lack of high-level semantics and complex program behaviors, it is challenging for binary analysis solutions to scale up to large real-world binaries in practice. Existing solutions are often task-driven and bounded by a practical time limit, which hinders comprehensively understanding of binaries. Furthermore, it is difficult to integrate the knowledge generated from different solutions. In this talk, we discuss our solutions, reflections, and ongoing efforts in scaling up binary analysis in a knowledge-oriented manner. We believe knowledge accumulation is the key to scale up binary analysis, where binary analysis solutions generate understandings that can be shared and reused in other solution. Our investigation includes techniques for knowledge extraction, \u00a0tools for knowledge integration, and platforms for knowledge accumulations and sharing. The accumulated knowledge not only allows broader and deeper analysis into binaries, it also enables emerging data-driven and learning techniques to be effectively adopted in binary analysis tasks.<\/p>\n

\u4e2a\u4eba\u4ecb\u7ecd\uff1a\u6881\u632f\u51ef\uff0c\u65b0\u52a0\u5761\u56fd\u7acb\u5927\u5b66\u8ba1\u7b97\u5b66\u9662\u526f\u6559\u6388\u3002\u4e3b\u8981\u7814\u7a76\u9886\u57df\u4e3a\u7cfb\u7edf\u5b89\u5168\u4e0eWeb\u5b89\u5168\uff0c\u76ee\u524d\u7814\u7a76\u4e3b\u8981\u96c6\u4e2d\u4e8e\u57fa\u4e8e\u6d4f\u89c8\u5668\u7684Web\u5e94\u7528\u5b89\u5168\u68c0\u6d4b\u4e0e\u9632\u62a4\u3001\u8fdc\u7a0b\u653b\u51fb\u7684\u54cd\u5e94\u548c\u5206\u6790\u3001\u4ee5\u53ca\u8f6f\u4ef6\u8c03\u8bd5\uff0c\u76f8\u5173\u5de5\u4f5c\u53d1\u8868\u4e8eACM CCS, IEEE Security & Privacy, ACM SIGSOFT FSE, Usenix Security Symposium, NDSS\u7b49\u9876\u7ea7\u56fd\u9645\u4f1a\u8bae\u548cIEEE Transactions on Dependable and Secure<\/p>\n

Computing (TDSC)\u3001ACM Transactions on Software Engineering and Methodology (TOSEM)\u3001 ACM Transactions on Information and System Security (TISSEC)\u7b49\u9876\u7ea7\u56fd\u9645\u671f\u520a\u3002\u6881\u632f\u51ef\u535a\u58eb\u66fe\u83b7\u5f97\u591a\u4e2a\u7814\u7a76\u548c\u6559\u5b66\u5956\u9879\uff0c\u5176\u4e2d\u5305\u62ec\uff1a2014\u5e74ICECCS\u6700\u4f73\u8bba\u6587\u5956\uff0c2014\u5e74W2SP\u6700\u4f73\u8bba\u6587\u5956\uff0c2009\u5e74ACM SIGSOFT ESEC\/FSE \u6770\u51fa\u8bba\u6587\u5956\u30012007\u5e74USENIX Security Symposium \u6700\u4f73\u8bba\u6587\u5956\u30012003\u5e74Annual Computer Security Applications Conference (ACSAC) \u6770\u51fa\u8bba\u6587\u5956\uff0c2008\u5e74\u65b0\u52a0\u5761\u56fd\u7acb\u5927\u5b66\u7684\u9752\u5e74\u7814\u7a76\u4eba\u5458\u5956\uff0c2014\u5e74\u548c2015\u5e74\u65b0\u52a0\u5761\u56fd\u7acb\u5927\u5b66\u5e74\u5ea6\u6770\u51fa\u6559\u5b66\u5956\u3002\u6881\u632f\u51ef\u535a\u58eb2006\u5e74\u81ea\u7ebd\u7ea6\u5dde\u7acb\u5927\u5b66\u77f3\u6eaa\u5206\u6821\uff08Stony Brook University\uff09\u83b7\u5f97\u535a\u58eb\u5b66\u4f4d\uff0c1999\u5e74\u4e8e\u5317\u4eac\u5927\u5b66\u83b7\u5f97\u8ba1\u7b97\u673a\u5b66\u58eb\u5b66\u4f4d\u548c\u7ecf\u6d4e\u5b66\u5b66\u58eb\u5b66\u4f4d\u3002<\/p>\n

\u9898\u76ee\uff1aNeural Nets Can Learn Function Type Signatures From Binaries<\/strong><\/p>\n

\"\"<\/a><\/p>\n

\u8bb2\u8005\uff1aChua Zheng Leong\u00a0\u535a\u58eb<\/strong><\/p>\n

\u6458\u8981\uff1aFunction type signatures are important for binary analysis, but they are not available in COTS binaries. In this paper, we present a new system called EKLAVYA which trains a recurrent neural network to recover function type signatures from disassembled binary code. EKLAVYA assumes no knowledge of the target instruction set semantics to make such inference. More importantly, EKLAVYA results are \u201cexplicable\u201d: we find by analyzing its model that it auto-learns relationships between instructions, compiler conventions, stack frame setup instructions, use-before-write patterns, and operations relevant to identifying types directly from binaries. In our evaluation on Linux binaries compiled with clang and gcc, for two different architectures (x86 and x64), EKLAVYA exhibits accuracy of around 84% and 81% for function argument count and type recovery tasks respectively. EKLAVYA generalizes well across the compilers tested on two different instruction sets with various optimization levels, without any specialized prior knowledge of the instruction set, compiler or optimization level.<\/p>\n

\u4e2a\u4eba\u4ecb\u7ecd\uff1aChua Zheng Leong, \u535a\u58eb\uff0c\u65b0\u52a0\u5761\u56fd\u7acb\u5927\u5b66\u52a9\u7406\u7814\u7a76\u5458\u3002\u4e3b\u8981\u7814\u7a76\u9886\u57df\u4e3a\u7cfb\u7edf\u5b89\u5168\uff0c\u4e8c\u8fdb\u5236\u5206\u6790\u6280\u672f\u4e0e\u673a\u5668\u5b66\u4e60\uff0c\u76f8\u5173\u5de5\u4f5c\u53d1\u8868\u4e8e Usenix Security Symposium\uff0cACM CCS, IEEE Security & Privacy, NDSS\u7b49\u9876\u7ea7\u56fd\u9645\u4f1a\u8bae\uff0c\u505a\u4e3a\u6838\u5fc3\u6210\u5458\u521b\u5efa\u4e86\u65b0\u52a0\u5761\u56fd\u7acb\u5927\u5b66Greyhats\u56e2\u961f\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

\u201c\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u201d\u5b66\u672f\u6c99\u9f99\u7b2c\u516d\u6b21\u6d3b\u52a8\u5c06\u4e8e2018\u5e746\u670827\u65e5\uff08\u661f\u671f\u4e09\u4e0a\u5348\uff099\u70b9\u5728\u4e2d\u56fd\u79d1\u5b66\u9662\u8f6f\u4ef6\u7814\u7a76\u62405… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-2565","post","type-post","status-publish","format-standard","hentry","category-events"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/2565","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2565"}],"version-history":[{"count":3,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/2565\/revisions"}],"predecessor-version":[{"id":2572,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/2565\/revisions\/2572"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2565"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2565"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2565"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}