SaTC: CORE: Small: Precise and Robust Binary Reverse Engineering and its Applications

SaTC：核心：小型：精确而鲁棒的二进制逆向工程及其应用

• 批准号: 2243632
• 负责人: Gang Tan
• 金额: $ 60万
• 依托单位: Pennsylvania State Univ University Park
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-04-15 至 2026-03-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2243632&HistoricalAwards=false
• 关键词: SaTC; CORE; Small; Precise; Robust

Analyzing untrusted computer programs to detect malicious behavior is of paramount importance to computer security. Many programs running in computer systems do not come with their source code and are only available in an executable form, called binary programs . Analyzing binary programs directly is critical to preventing malware, which continues to disrupt the functioning of modern societies. This project presents crosscutting research, educational opportunities, and an outreach plan to improve the accuracy, robustness, and scalability of binary program analysis and has the potential of fundamentally enhancing the ability of understanding and preventing malware.The core of this project's binary-analysis framework has two novel techniques: (1) a new pointer analysis technique based on a memory model called the block memory model and (2) an implementation of the core analysis as rules in a declarative language called Datalog that can be efficiently solved. This project will have three tasks based on these techniques. (1) In Task A the project will produce a comprehensive framework called Blockbin, which can produce precise reverse-engineering information of an input binary program. The framework will handle binary programs that are produced from different source languages that are for different architectures, and that have been obfuscated. (2) Task B will focus on demonstrating the utility of Blockbin through a diverse set of applications from program hardening to authorship attribution and to malware analysis. (3) Task C will focus on improving the scalability of Blockbin by designing a highly parallel Datalog solver with support for lattice-based static analysis. The result will be a tool that generates high-precision reverse-engineering information for sophisticated binaries and a demonstration of the tool's utility in a diverse set of applications.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

分析未经信任的计算机程序来检测恶意行为对于计算机安全至关重要。许多在计算机系统中运行的程序都不包含其源代码，仅以可执行的形式（称为二进制程序）可用。直接分析二进制程序对于防止恶意软件至关重要，这继续破坏现代社会的功能。该项目提出了横切研究，教育机会以及推广计划，以提高二元计划分析的准确性，鲁棒性和可伸缩性，并具有从根本上增强理解和预防恶意软件的能力的潜力。该项目的二进制分析框架的核心。基于记忆模型的核心模型（2）核心模型（2），该项目的二进制分析框架具有两种新技术：（1）（1）可以有效解决的数据元。该项目将根据这些技术具有三个任务。 （1）在任务A中，该项目将产生一个称为Blockbin的综合框架，该框架可以生成输入二进制程序的精确反向工程信息。 该框架将处理来自不同架构的不同源语言产生的二进制程序，这些程序已被混淆。 （2）任务B将通过一组从程序硬化到作者身份归因到恶意软件分析的多种应用程序来展示Blockbin的实用性。 （3）任务C将通过设计高度并行数据求解器，并支持基于晶格的静态分析来提高Blockbin的可扩展性。结果将是一种工具，该工具为复杂的二进制文件生成了高精度的反向工程信息，并在各种应用程序中展示了该工具的实用性。该奖项反映了NSF的法定任务，并被认为是值得通过基金会的知识分子优点和更广泛影响的审查标准来通过评估来通过评估来获得支持的。