The Experts below are selected from a list of 141 Experts worldwide ranked by ideXlab platform
Wolfgang Mueller - One of the best experts on this subject based on the ideXlab platform.
-
EMSOFT - XEMU: an efficient QEMU based binary mutation testing framework for embedded software
Proceedings of the tenth ACM international conference on Embedded software - EMSOFT '12, 2012Co-Authors: Markus Becker, Christoph Kuznik, Mabel Mary Joy, Daniel Baldin, Tao Xie, Wolfgang MuellerAbstract:This paper presents the XEMU framework for mutation based testing of embedded software binaries. We apply an extension of the QEMU software emulator, which injects mutations at run-time by dynamic Code translation without affecting the binary software under test. The injection is based on a mutation table, which is generated by control flow graph (CFG) analysis of the Disassembled Code prior to its execution without presuming access to source Code. We introduce our approach by the example of the ARM instruction set architecture for which a mutation taxonomy is presented. In addition to extending the testing scope to target specific low level faults, XEMU addresses the reduction of the mutants creation, execution, and detection overheads. Moreover, we reduce testing efforts by applying binary CFG analysis and constraint-based test generation for improved test quality. The experimental results of a car motor management software show significant improvements over conventional source Code based approaches while providing 100% accuracy in terms of the computed test quality metrics.
-
XEMU: An efficient QEMU based binary mutation testing framework for embedded software
EMSOFT'12 - Proceedings of the 10th ACM International Conference on Embedded Software 2012 Co-located with ESWEEK, 2012Co-Authors: Markus Becker, Christoph Kuznik, Mabel Mary Joy, Daniel Baldin, Tao Xie, Wolfgang MuellerAbstract:This paper presents the XEMU framework for mutation based testing of embedded software binaries. We apply an extension of the QEMU software emulator, which injects mutations at run-time by dynamic Code translation without affecting the binary software under test. The injection is based on a mutation table, which is generated by control flow graph (CFG) analysis of the Disassembled Code prior to its execution without presuming access to source Code. We introduce our approach by the example of the ARM instruction set architecture for which a mutation taxonomy is presented. In addition to extending the testing scope to target specific low level faults, XEMU addresses the reduction of the mutants creation, execution, and detection overheads. Moreover, we reduce testing efforts by applying binary CFG analysis and constraint-based test generation for improved test quality. The experimental results of a car motor management software show significant improvements over conventional source Code based approaches while providing 100% accuracy in terms of the computed test quality metrics. Copyright 2012 ACM.
Sebastian Porst - One of the best experts on this subject based on the ideXlab platform.
-
REIL: A platformindependent intermediate representation of Disassembled Code for static Code analysis, CanSecWest 2009
2015Co-Authors: Thomas Dullien, Sebastian PorstAbstract:In this paper we introduce REIL (Reverse Engineering In-termediate Language), a platform-independent intermediate language to represent Disassembled assembly Code. We cre-ated the REIL language specifically to simplify and auto-mate static Code analysis of assembly Code in the context of software reverse engineering for the purpose of security auditing and vulnerability detection. This paper introduces the complete REIL language with all of its instructions as well as the virtual REIL architec-ture that defines the effects of REIL instructions on registers and memory. Furthermore we discuss the reasons why we designed the REIL language the way we did, what limita-tions the user of the language should be aware of, and what we have planned for REIL in the future
-
reil a platform independent intermediate representation of Disassembled Code for static Code analysis
2009Co-Authors: Thomas Dullien, Sebastian PorstAbstract:In this paper we introduce REIL (Reverse Engineering Intermediate Language), a platform-independent intermediate language to represent Disassembled assembly Code. We created the REIL language specifically to simplify and automate static Code analysis of assembly Code in the context of software reverse engineering for the purpose of security auditing and vulnerability detection. This paper introduces the complete REIL language with all of its instructions as well as the virtual REIL architecture that defines the effects of REIL instructions on registers and memory. Furthermore we discuss the reasons why we designed the REIL language the way we did, what limitations the user of the language should be aware of, and what we have planned for REIL in the future.
Sage Havens - One of the best experts on this subject based on the ideXlab platform.
-
identifying ubiquitious third party libraries in compiled executables using annotated and translated Disassembled Code with supervised machine learning
IEEE Symposium on Security and Privacy, 2020Co-Authors: Jedediah Haile, Sage HavensAbstract:The size and complexity of the software ecosystem is a major challenge for vendors, asset owners and cybersecurity professionals who need to understand the security posture of these systems. Annotated and Translated Disassembled Code is a graph based datastore designed to organize firmware and software analysis data across builds, packages and systems, providing a highly scalable platform enabling automated binary software analysis tasks including corpora construction and storage for machine learning. This paper describes an approach for the identification of ubiquitous third-party libraries in firmware and software using Annotated and Translated Disassembled Code and supervised machine learning. Annotated and Translated Disassembled Code provide matched libraries, function names and addresses of previously unidentified Code in software as it is being automatically analyzed. This data can be ingested by other software analysis tools to improve accuracy and save time. Defenders can add the identified libraries to their vulnerability searches and add effective detection and mitigation into their operating environment.
-
SP Workshops - Identifying Ubiquitious Third-Party Libraries in Compiled Executables Using Annotated and Translated Disassembled Code with Supervised Machine Learning
2020 IEEE Security and Privacy Workshops (SPW), 2020Co-Authors: Jedediah Haile, Sage HavensAbstract:The size and complexity of the software ecosystem is a major challenge for vendors, asset owners and cybersecurity professionals who need to understand the security posture of these systems. Annotated and Translated Disassembled Code is a graph based datastore designed to organize firmware and software analysis data across builds, packages and systems, providing a highly scalable platform enabling automated binary software analysis tasks including corpora construction and storage for machine learning. This paper describes an approach for the identification of ubiquitous third-party libraries in firmware and software using Annotated and Translated Disassembled Code and supervised machine learning. Annotated and Translated Disassembled Code provide matched libraries, function names and addresses of previously unidentified Code in software as it is being automatically analyzed. This data can be ingested by other software analysis tools to improve accuracy and save time. Defenders can add the identified libraries to their vulnerability searches and add effective detection and mitigation into their operating environment.
Andrew H. Sung - One of the best experts on this subject based on the ideXlab platform.
-
Disassembled Code analyzer for malware dcam
Information Reuse and Integration, 2005Co-Authors: A. Sulaiman, K. Ramamoorthy, Srinivas Mukkamala, Andrew H. SungAbstract:Current static malware detection techniques have serious limitations. Little modifications can result in a new strand of malware that escapes. In this paper, we present a static detection technique using disassembly of a malware emphasizing the recognition of variants of a malware in its signature set. The hypothesis is that all variants share a common core signature that is a combination of several features of the Code. In addition to malware, spyware and adware are also analyzed to find the similar features. A previously identified malware can be analyzed to extract the signature, which will then be used to recognize its variants. Since this technique uses Disassembled Code, it can be used on any operating system. Encouraging experimental results on a set of malware are presented. Since the existence of spyware and adware is increasing, an analysis on how this technique can be extended to detect spyware is also presented.
-
Malware examiner using Disassembled Code (MEDiC)
Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop, 2005Co-Authors: A. Sulaiman, K. Ramamoorthy, Srinivas Mukkamala, Andrew H. SungAbstract:Current static malware detection techniques have serious limitations, and sandbox testing also fails to provide a complete solution due to time constraints. In this paper, we present a robust assembly language signature-based malware detection technique, with emphasis on detecting obfuscated (or polymorphic) malware and mutated (or metamorphic) malware. The hypothesis is that all versions of the same malware share a common core signature that is a combination of several features of the Code. After a particular malware has been first identified, it can be analyzed to extract the signature, which provides a basis for detecting variants and mutants of the same malware in the future. Given that the technique uses Disassembled Code, it can be used on any operating system. Encouraging experimental results on a large set of recent malware are presented.
-
IRI - Disassembled Code analyzer for malware (DCAM)
IRI -2005 IEEE International Conference on Information Reuse and Integration Conf 2005., 2005Co-Authors: A. Sulaiman, K. Ramamoorthy, Srinivas Mukkamala, Andrew H. SungAbstract:Current static malware detection techniques have serious limitations. Little modifications can result in a new strand of malware that escapes. In this paper, we present a static detection technique using disassembly of a malware emphasizing the recognition of variants of a malware in its signature set. The hypothesis is that all variants share a common core signature that is a combination of several features of the Code. In addition to malware, spyware and adware are also analyzed to find the similar features. A previously identified malware can be analyzed to extract the signature, which will then be used to recognize its variants. Since this technique uses Disassembled Code, it can be used on any operating system. Encouraging experimental results on a set of malware are presented. Since the existence of spyware and adware is increasing, an analysis on how this technique can be extended to detect spyware is also presented.
Markus Becker - One of the best experts on this subject based on the ideXlab platform.
-
EMSOFT - XEMU: an efficient QEMU based binary mutation testing framework for embedded software
Proceedings of the tenth ACM international conference on Embedded software - EMSOFT '12, 2012Co-Authors: Markus Becker, Christoph Kuznik, Mabel Mary Joy, Daniel Baldin, Tao Xie, Wolfgang MuellerAbstract:This paper presents the XEMU framework for mutation based testing of embedded software binaries. We apply an extension of the QEMU software emulator, which injects mutations at run-time by dynamic Code translation without affecting the binary software under test. The injection is based on a mutation table, which is generated by control flow graph (CFG) analysis of the Disassembled Code prior to its execution without presuming access to source Code. We introduce our approach by the example of the ARM instruction set architecture for which a mutation taxonomy is presented. In addition to extending the testing scope to target specific low level faults, XEMU addresses the reduction of the mutants creation, execution, and detection overheads. Moreover, we reduce testing efforts by applying binary CFG analysis and constraint-based test generation for improved test quality. The experimental results of a car motor management software show significant improvements over conventional source Code based approaches while providing 100% accuracy in terms of the computed test quality metrics.
-
XEMU: An efficient QEMU based binary mutation testing framework for embedded software
EMSOFT'12 - Proceedings of the 10th ACM International Conference on Embedded Software 2012 Co-located with ESWEEK, 2012Co-Authors: Markus Becker, Christoph Kuznik, Mabel Mary Joy, Daniel Baldin, Tao Xie, Wolfgang MuellerAbstract:This paper presents the XEMU framework for mutation based testing of embedded software binaries. We apply an extension of the QEMU software emulator, which injects mutations at run-time by dynamic Code translation without affecting the binary software under test. The injection is based on a mutation table, which is generated by control flow graph (CFG) analysis of the Disassembled Code prior to its execution without presuming access to source Code. We introduce our approach by the example of the ARM instruction set architecture for which a mutation taxonomy is presented. In addition to extending the testing scope to target specific low level faults, XEMU addresses the reduction of the mutants creation, execution, and detection overheads. Moreover, we reduce testing efforts by applying binary CFG analysis and constraint-based test generation for improved test quality. The experimental results of a car motor management software show significant improvements over conventional source Code based approaches while providing 100% accuracy in terms of the computed test quality metrics. Copyright 2012 ACM.