KNOWLEDGE-ORIENTED BINARY ANALYSIS

Abstract

Binary analysis has always been the cornerstone of system security. By analyzing the challenges faced by existing approaches, we identified the lack of knowledge abstraction as the most important problem for binary analysis at scale. In this thesis, we investigate how knowledge can be automatically recovered and be effectively managed. For knowledge extraction, we present EKLAVYA, a method for recovering function argument signatures using a recurrent neural network and techniques to understand the results. TAINTINDUCE is an inductive method to learn the data dependency of an instruction with minimal achitecture knowledge. As an on-going work, we propose and develop a new binary analysis framework that is based on a knowledge-oriented methodology called SQUIRREL. Finally, we showcase the efficacy of such a knowledge-oriented approach by retrofitting two source-based security applications and also developing a reassembler, SQUIRRELREASM, for the ARM32 ISA using the framework.