一句话：提出基于定义-使用关系覆盖的路径探索策略与渐进自监督模糊测试，提升强制执行的恶意行为暴露。
本文针对恶意软件利用隐藏技术逃避分析的问题，研究强制执行中的路径探索策略。现有强制执行工具虽能通过强制设置分支结果绕过自我保护，但多采用线性搜索，容易造成冗余路径探索并遗漏隐藏行为。为此，作者提出一种面向二进制中定义-使用关系覆盖的新型路径探索策略，并设计模糊测试方法，以渐进、自监督的方式探索这些关系。实验从内存依赖覆盖率和恶意软件行为暴露两方面评估。结果表明，该方法在这两项指标上均优于现有强制执行工具，能够更有效地穿透恶意软件保护并暴露其行为。
The evolution of recent malware, characterized by the escalating use of cloaking techniques, poses a significant challenge in the analysis of malware behaviors. Researchers proposed forced execution to penetrate malware’s self-protection mechanisms and expose hidden behaviors, by forcefully setting certain branch outcomes. Existing studies focus on enhancing the forced executor to provide light-weight crash-free execution models. However, insufficient attention has been directed toward the path exploration strategy, an aspect equally crucial to the effectiveness. Linear search employed in state-of-the-art forced execution tools exhibits inherent limitations that lead to unnecessary path exploration and incomplete behavior exposure. In this paper, we propose a novel and practical path exploration strategy that focuses on the coverage of defineuse relations in the subject binary. We develop a fuzzing approach for exploring these define-use relations in a progressive and self-supervised way. Our experimental results show that the proposed solution outperforms the existing forced execution tools in both memory dependence coverage and malware behavior exposure.
DOI 原文 ·
@inproceedings{paperbot8535,
title = {Define-Use Guided Path Exploration for Better Forced Execution},
author = {Dongnan He and Dongchen Xie and Yujie Wang and Wei You and Bin Liang and Jianjun Huang and Wenchang Shi and Zhuo Zhang and Xiangyu Zhang},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3652128}
}