基于用户系统调用序列的二进制代码识别  

Binary code identification based on user system call sequences

作　　者：黄海翔 彭双和[1] 钟子煜 HUANG Haixiang;PENG Shuanghe;ZHONG Ziyu(College of Computer and Information Technology,Beijing Jiaotong University,Beijing 100044,China;Faculty of Science,the Hong Kong University of Science and Technology,Hong Kong 999077,China)

机构地区：[1]北京交通大学计算机与信息技术学院,北京100044 [2]香港科技大学理学院,中国香港999077

出　　处：《计算机应用》2024年第7期2160-2167,共8页journal of Computer Applications

基　　金：国家自然科学基金资助项目(62272028)。

摘　　要：针对编译优化、跨编译器、混淆等带来的二进制代码相似性识别准确率低的问题,提出并实现了一种基于用户系统调用序列的识别方案UstraceDiff。首先,基于Intel Pin框架设计了一个动态分析插桩工具,动态提取二进制代码的用户系统调用序列及参数;其次,通过序列对齐获得被分析的2个二进制代码的系统调用序列的公有序列,并设计了一个有效参数表用于筛选出有效系统调用参数;最后,为评估二进制代码的相似性,提出一种算法利用公有序列及有效参数,计算它们的同源度。使用Coreutils数据集在4种不同的编译条件下对UstraceDiff进行了评估。实验结果表明,相较于Bindiff和DeepBinDiff,UstraceDiff对于同源程序识别的平均准确率分别提高了35.1个百分点和55.4个百分点,对于非同源程序的区分效果也更好。In order to solve the low accuracy problem of binary code identification caused by compilation optimization,cross-compiler,obfuscation,etc.,UstraceDiff,an identification scheme based on user system call sequences,was proposed.First,to extract the sequences of user system calls and parameters of the binary codes,a dynamic binary instrumentation tool based on Intel Pin framework was designed.Second,the common sequences of system call sequences of two compared binary codes were obtained through sequence alignment,and a valid parameter table was designed to filter out valid system call parameters.Finally,an algorithm was proposed to evaluate the similarity of binary codes by combining the common sequences and valid parameters to calculate the homology score.UstraceDiff was evaluated by using the Coreutils dataset under four different compilation conditions.The results show that the average accuracy of UstraceDiff for homologous program identification is 35.1 percentage points and 55.4 percentage points higher than those of Bindiff and DeepBinDiff respectively,and the distinction effect for non-homologous programs of UstraceDiff is also better.

关 键 词：代码识别 动态分析 系统调用 程序溯源 二进制相似性分析 

分 类 号：TP313[自动化与计算机技术—计算机软件与理论]