Multi-Firmware Comparison Based on Evolutionary Algorithm and Trusted Base Point
Source abstract
Abstract
Multi-firmware comparison techniques can improve efficiency when auditing firmwares in bulk. However, the problem of matching functions between multiple firmwares has not been studied before. This paper proposes a multi-firmware comparison method based on evolutionary algorithms and trusted base points. We first model the multi-firmware comparison as a multi-sequence matching problem. Then, we propose an adaptation function and a population generation method based on trusted base points. Finally, we apply an evolutionary algorithm to find the optimal result. At the same time, we design the similarity of matching results as an evaluation metric to measure the effect of multi-firmware comparison. The experiments show that the proposed method outperforms Bindiff and the string-based method. Precisely, the similarity between the matching results of the proposed method and Bindiff matching results is 61%, and the similarity between the matching results of the proposed method and the string-based method is 62.8%. By sampling and manual verification, the accuracy of the matching results of the proposed method can be about 66.4%.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (37)
Show source-provided references
1. History of microcontrollers: first 50 years10.1109/MM.2021.3114754 ↗
2. Unveiling IoT security in reality: a firmware-centric journey
3. Your firmware has arrived: a study of firmware update vulnerabilities
4. Improving ML-based binary function similarity detection by assessing and deprioritizing control flow graph features
5. Code is not natural language: unlock the power of semantics-oriented graph representation for binary code similarity detection
6. Collyer J, Watson T, Phillips I. Faser: binary code similarity search through the use of intermediate representations. arXiv:2310.03605. 2023.
7. Learning transferable binary code representations with natural language supervision
8. A fast malware detection model based on heterogeneous graph similarity search10.1016/j.comnet.2024.110799 ↗
9. Multistage malware detection method for backup systems10.3390/technologies12020023 ↗
10. MTMG: a framework for generating adversarial examples targeting multiple learning-based malware detection systems
11. ERMDS: a obfuscation dataset for evaluating robustness of learning-based malware detection system10.1016/j.tbench.2023.100106 ↗
12. The impact of inter-procedural code obfuscation on binary diffing techniques
13. Open-source tools and benchmarks for code-clone detection: past, present, and future trends10.1145/3381307.3381310 ↗
14. Semantics-based obfuscation-resilient binary code similarity comparison with applications to software and algorithm plagiarism detection10.1109/TSE.2017.2655046 ↗
15. Cross-architecture bug search in binary executables
16. Extracting conditional formulas for cross-platform bug search
17. CEBin: a cost-effective framework for large-scale binary code similarity detection
18. Precise and accurate patch presence test for binaries
19. SPAIN: security patch analysis for binaries towards understanding the pain and pills
20. PG-VulNet: detect supply chain vulnerabilities in IoT devices using pseudo-code and graphs
21. Semantic-based patch presence testing for downstream kernels
22. A survey of binary code similarity10.1145/3446371 ↗
23. BinDiff [Internet]. Zynamics; 2021. [cited 2024 Mar 5]. Available from: https://www.zynamics.com/bindiff.html.
24. DeepBinDiff: learning program-wide code representations for binary diffing
25. Scalable graph-based bug search for firmware images
26. Polymorphic worm detection using structural information of executables
27. Mutantx-s: scalable malware clustering based on static features
28. Binclone: detecting code clones in malware
29. Jump-aware transformer for binary code similarity detection
30. VulHawk: cross-architecture vulnerability detection with entropy-based binary code search
31. Detecting code clones in binary executables
32. Idea: opcode-sequence-based malware detection
33. Malware classification method via binary content comparison
34. Lines of malicious code: insights into the malicious software industry
35. Binary function clustering using semantic hashes
36. Towards automatic software lineage inference
37. Identifying shared software components to support malware forensics