一句话：提出 RENN，用新型 RNN 辅助二进制内存别名分析，提升反向执行与崩溃根因定位效率。
反向执行与 coredump 分析常用于诊断软件崩溃，但在处理内存别名时能力不足；已有假设检验方法计算复杂，难以实用。本文提出新型深度神经网络架构，用 RNN 学习与内存访问相关的二进制代码模式，推断内存引用所访问的区域。不同区域的引用自然构成非别名关系，从而减少反向执行中追踪非别名关系的假设检验开销。该网络能捕获机器码片段间的数据依赖。作者实现 RENN 系统，并在 40 个真实内存破坏漏洞触发的崩溃上评估。相比当前最优技术，RENN 执行时间平均快 36.25%，多检测 21.35% 非别名对，并多成功定位 12.5% 的根因案例。
Reverse execution and coredump analysis have long been used to diagnose the root cause of software crashes. Each of these techniques, however, face inherent challenges, such as insufficient capability when handling memory aliases. Recent works have used hypothesis testing to address this drawback, albeit with high computational complexity, making them impractical for real world applications. To address this issue, we propose a new deep neural architecture, which could significantly improve memory alias resolution. At the high level, our approach employs a recurrent neural network (RNN) to learn the binary code pattern pertaining to memory accesses. It then infers the memory region accessed by memory references. Since memory references to different regions naturally indicate a non-alias relationship, our neural architecture can greatly reduce the burden of doing hypothesis testing to track down non-alias relation in binary code. Different from previous researches that have utilized deep learning for other binary analysis tasks, the neural network proposed in this work is fundamentally novel. Instead of simply using off-the-shelf neural networks, we designed a new recurrent neural architecture that could capture the data dependency between machine code segments. To demonstrate the utility of our deep neural architecture, we implement it as RENN, a neural network-assisted reverse execution system. We utilize this tool to analyze software crashes corresponding to 40 memory corruption vulnerabilities from the real world. Our experiments show that RENN can significantly improve the efficiency of locating the root cause for the crashes. Compared to a state-of-the-art technique, RENN has 36.25% faster execution time on average, detects an average of 21.35% more non-alias pairs, and successfully identified the root cause of 12.5% more cases.
DOI 原文 ·
@inproceedings{paperbot5292,
title = {RENN: Efficient Reverse Execution with Neural-Network-Assisted Alias Analysis},
author = {Dongliang Mu and Wenbo Guo and Alejandro Cuevas and Yueqi Chen and Jinxuan Gai and Xinyu Xing and Bing Mao and Chengyu Song},
booktitle = {ASE},
year = {2019},
doi = {10.1109/ase.2019.00090}
}