一句话：提出首个混合敏感类型推断 Manta，为剥离二进制恢复精确类型并用于剪枝，提升漏洞检测精度。
剥离二进制中类型信息丢失，导致静态漏洞检测难以剪除不可行事实、精度受限。本文提出首个混合敏感类型推断方法 Manta，将不同敏感度的数据流分析相结合，互为补充，为大量变量推断精确类型；推断出的类型进一步用于剪枝不可行的间接调用目标与数据依赖，从而辅助漏洞检测。实验表明，Manta 类型推断达到 78.7% 精确率和 97.2% 召回率，相比已有类型分析可多剪除 63.9% 的不可行间接调用目标，二进制程序切片与源码切片的相似度达 61.1%。此外，Manta 在流行 IoT 固件中发现 86 个开发者确认的新漏洞，获得 64 个 CVE/PSV 编号。
Static binary bug detection has been a prominent approach for ensuring the security of binaries used in our daily lives. However, the type information lost in binaries prevents the improvement opportunity for a static analyzer to utilize type information to prune away infeasible facts and increase analysis precision. To make binary bug detection more practical with higher precision, in this work, we propose the first hybrid-sensitive type inference, Manta, that combines data-flow analysis with different sensitivities to complement each other and infer precise types for many variables. The inferred types are then used to assist with bug detection by pruning infeasible indirect call targets and data dependencies. Our experiments indicate Manta outperforms prior work by inferring types with 78.7% precision and 97.2% recall. Based on the inferred types, we can prune away 63.9% more infeasible indirect-call targets compared to existing type analysis techniques and perform program slicing on binaries with 61.1% similarity to that on source code. Moreover, Manta has led to 86 new developer-confirmed vulnerabilities in many popular IoT firmware, with 64 CVE/PSV IDs assigned.
@inproceedings{YeCZ0L024,
title = {Manta: Hybrid-Sensitive Type Inference Toward Type-Assisted Bug Detection for Stripped Binaries},
author = {Chengfeng Ye and Yuandao Cai and Anshunkang Zhou and Heqing Huang and Hao Ling and Charles Zhang},
booktitle = {ASPLOS},
year = {2024},
doi = {10.1145/3622781.3674177}
}