Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis

09/04/2019
by   Ramtine Tofighi-Shirazi, et al.
0

We present a new approach that bridges binary analysis techniques with machine learning classification for the purpose of providing a static and generic evaluation technique for opaque predicates, regardless of their constructions. We use this technique as a static automated deobfuscation tool to remove the opaque predicates introduced by obfuscation mechanisms. According to our experimental results, our models have up to 98 and deob-fuscating state-of-the-art opaque predicates patterns. By contrast, the leading edge deobfuscation methods based on symbolic execution show less accuracy mostly due to the SMT solvers constraints and the lack of scalability of dynamic symbolic analyses. Our approach underlines the efficiency of hybrid symbolic analysis and machine learning techniques for a static and generic deobfuscation methodology.

READ FULL TEXT
11/26/2017

Improving Function Coverage with Munch: A Hybrid Fuzzing and Directed Symbolic Execution Approach

Fuzzing and symbolic execution are popular techniques for finding vulner...
06/07/2019

Datalog Disassembly

Disassembly is fundamental to binary analysis and rewriting. We present ...
11/18/2019

Fine-Grained Static Detection of Obfuscation Transforms Using Ensemble-Learning and Semantic Reasoning

The ability to efficiently detect the software protections used is at a ...
07/02/2018

Neuro-Symbolic Execution: The Feasibility of an Inductive Approach to Symbolic Execution

Symbolic execution is a powerful technique for program analysis. However...
04/12/2022

Malware Analysis with Symbolic Execution and Graph Kernel

Malware analysis techniques are divided into static and dynamic analysis...
01/12/2018

Symbolic Timed Observational Equivalence

Intruders can infer properties of a system by measuring the time it take...
06/29/2020

Scaling Symbolic Methods using Gradients for Neural Model Explanation

Symbolic techniques based on Satisfiability Modulo Theory (SMT) solvers ...