一句话：结合语义学习快速筛选与函数语义仿真重排，提升二进制漏洞搜索准确率并免除人工确认。
基于学习的二进制漏洞搜索准确率有限，工业实践中仍需人工从 top-M 结果中确认真正阳性。VulSeeker-Pro 在语义学习后端集成函数语义仿真：先用语义学习预测器快速选出与漏洞最相似的目标二进制函数 top-M 候选，再由仿真引擎重排，得到更准确的 top-N。该方法通过快速过滤与动态执行轨迹生成，在较低时间开销下提升准确率。在 15 个已知 CVE、6 个工业常用程序上，45 次搜索中 top-1/top-5 分别找到 40/43 个真实漏洞，为 Gemini 的 12.33×/2.58×；平均 0.22 秒判定目标函数是否含已知漏洞。
Learning-based clone detection is widely exploited for binary vulnerability search. Although they solve the problem of high time overhead of traditional dynamic and static search approaches to some extent, their accuracy is limited, and need to manually identify the true positive cases among the top-M search results during the industrial practice. This paper presents VulSeeker-Pro, an enhanced binary vulnerability seeker that integrates function semantic emulation at the back end of semantic learning, to release the engineers from the manual identification work. It first uses the semantic learning based predictor to quickly predict the top-M candidate functions which are the most similar to the vulnerability from the target binary. Then the top-M candidates are fed to the emulation engine to resort, and more accurate top-N candidate functions are obtained. With fast filtering of semantic learning and dynamic trace generation of function semantic emulation, VulSeeker-Pro can achieve higher search accuracy with little time overhead. The experimental results on 15 known CVE vulnerabilities involving 6 industry widely used programs show that VulSeeker-Pro significantly outperforms the state-of-the-art approaches in terms of accuracy. In a total of 45 searches, VulSeeker-Pro finds 40 and 43 real vulnerabilities in the top-1 and top-5 candidate functions, which are 12.33× and 2.58× more than the most recent and related work Gemini. In terms of efficiency, it takes 0.22 seconds on average to determine whether the target binary function contains a known vulnerability or not.
DOI 原文 ·
@inproceedings{paperbot4665,
title = {VulSeeker-pro: enhanced semantic learning based binary vulnerability seeker with emulation},
author = {Jian Gao and Xin Yang and Ying Fu and Yu Jiang and Heyuan Shi and Jiaguang Sun},
booktitle = {FSE},
year = {2018},
doi = {10.1145/3236024.3275524}
}