.png){kind=icon}
.png){kind=icon}
Return
BinVulDet: Detecting vulnerability in binary program via decompiled pseudo code and BiLSTM-attention
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2022.103023.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Static detection of security vulnerabilities in binary programs is an important research field in software supply chain security. However, existing vulnerability detection methods based on code similarity can only detect known vulnerabilities. Vulnerability features generated by vulnerability pattern-based detec-tion methods are low robust due to the influence of manually defined patterns, compiler diversity, and irrelevant function instructions. In this paper, we propose BinVulDet, which is a binary level vulnerability detection tool for accurate known and unknown vulnerability detection. BinVulDet uses decompilation techniques to obtain pseudo code containing high-level semantic information against the impact of com-pilation diversity. Then the program slicing technique is used to extract the statements with data depen-dencies and control dependencies related to the vulnerability. A BiLSTM-attention neural network is used to extract rich contextual semantic information from slice codes to generate more robust vulnerability patterns to detect vulnerabilities. The experimental results show that BinVulDet outperforms the state-of-the-art binary vulnerability detection methods. The FPR and FNR of BinVulDet are 1.04% and 0.89% on average, respectively, which are 3.93% and 22.86% lower than the baseline model on average. BinVulDet can effectively against the influence of compilation diversity and successfully be used for real-world vul-nerability detection by being evaluated in three CVE vulnerability projects.(c) 2022 Elsevier Ltd. All rights reserved.
Keywords:
Binary program
Decompile
Vulnerability detection
Program slicing
BiLSTM-attention