Defeating program analysis techniques via Ambiguous Translation
This research explores the possibility of a new anti-analysis technique, carefully designed to attack weaknesses of the existing program analysis approaches. It encodes a program code snippet to hide, and its decoding process is implemented by a sophisticated state machine that produces multiple outputs depending on inputs. The key idea of the proposed technique is to ambiguously decode the program code, resulting in multiple decoded code snippets that are challenging to distinguish from each other. Our approach is stealthier than previous similar approaches as its execution does not exhibit different behaviors between when it decodes correctly or incorrectly. This paper also presents analyses of weaknesses of existing techniques and discusses potential improvements. We implement and evaluate the proof of concept approach, and our preliminary results show that the proposed technique imposes various new unique challenges to the program analysis technique. It also suggests a need for hybrid analysis that can complement the limitations of existing techniques to handle the proposed technique.
Thu 18 NovDisplayed time zone: Hobart change
22:00 - 23:00 | |||
22:00 20mTalk | Binary Diffing as a Network Alignment Problem via Belief Propagation Research Papers Elie Mengin SAMM, EA 4543 - Université Paris 1 Panthéon-Sorbonne, Fabrice Rossi CEREMADE, CNRS, UMR 7534 - Université Paris-Dauphine, PSL University | ||
22:20 20mTalk | CiFi: Versatile Analysis of Class and Field Immutability Research Papers Tobias Roth Technische Universität Darmstadt, Dominik Helm Technische Universität Darmstadt, Michael Reif Technische Universität Darmstadt, Mira Mezini Technische Universität Darmstadt | ||
22:40 10mTalk | Assessing Robustness of ML-Based Program Analysis Tools using Metamorphic Program Transformations NIER track Leonhard Applis Delft University of Technology, Annibale Panichella Delft University of Technology, Arie van Deursen Delft University of Technology, Netherlands Pre-print | ||
22:50 10mTalk | Defeating program analysis techniques via Ambiguous Translation NIER track Chijung Jung University of Virginia, Doowon Kim University of Tennessee, Knoxville, Weihang Wang University at Buffalo, SUNY, Yunhui Zheng IBM Research, Kyu Hyung Lee University of Georgia, Yonghwi Kwon University of Virginia |