一句话：提出 BinXray，通过补丁差分提取基本块轨迹签名，准确检测二进制程序中的 1-day 漏洞并降低误报。
该论文针对二进制函数匹配在 1-day 漏洞检测中误报率高的问题，提出补丁驱动的漏洞匹配方法 BinXray。准备阶段，通过比较漏洞版本与修补版本，利用基本块映射算法提取补丁签名，签名由基本块轨迹集合表示；检测阶段，利用修补语义裁剪无关轨迹以加速搜索，并设计轨迹相似度判断目标程序是否已包含补丁。实验收集 12 个真实软件项目、479 个 CVE，BinXray 达到 93.31% 准确率，每函数分析耗时仅 296.17ms，优于现有工作。
The binary-level function matching has been widely used to detect whether there are 1-day vulnerabilities in released programs. However, the high false positive is a challenge for current function matching solutions, since the vulnerable function is highly similar to its corresponding patched version. In this paper, the Binary X-Ray (BinXray), a patch based vulnerability matching approach, is proposed to identify the specific 1-day vulnerabilities in target programs accurately and effectively. In the preparing step, a basic block mapping algorithm is designed to extract the signature of a patch, by comparing the given vulnerable and patched programs. The signature is represented as a set of basic block traces. In the detection step, the patching semantics is applied to reduce irrelevant basic block traces to speed up the signature searching. The trace similarity is also designed to identify whether a target program is patched. In experiments, 12 real software projects related to 479 CVEs are collected. BinXray achieves 93.31% accuracy and the analysis time cost is only 296.17ms per function, outperforming the state-of-the-art works.
DOI 原文 ·
@inproceedings{paperbot6045,
title = {Patch based vulnerability matching for binary programs},
author = {Yifei Xu and Zhengzi Xu and Bihuan Chen and Fu Song and Yang Liu and Ting Liu},
booktitle = {ISSTA},
year = {2020},
doi = {10.1145/3395363.3397361}
}