二进制代码特征提取与智能分析

At present, the traditional malware detection technology cannot handle the fast-growing malware. To address the problem, in this project we focus on the binary code feature extraction and intelligent analysis in reverse analysis, which is of great significance in the field of malware detection. The researches of this project are detailed as following. (1) Based on the neural network model, this project studies the classification methods of binary files on different processor architectures. And then, the ByteWeight theory is used to identify binary functions, and the binary function features can be extracted finally. (2) By investigating the storage rule of debugging information, we propose an algorithm to accurately extract debugging information of binary files. Then, the debugging information injection technology is studies based on the reverse analysis tools. (3) To determine API association and the behavior of malicious software, we propose an algorithm based on associated objects model to associate the API which is logically related with each other in streaming of API call sequence. Next, we use API data dependency graph model to describe high-level behavior of program, and propose a behavior mining algorithm. Therefore, the aforementioned researches will provide a new method and idea for binary feature extraction in uncertain environment and malware behavior extraction.

目前，传统的恶意软件检测技术已不能应对恶意软件的迅猛增长。针对此问题，本项目研究二进制代码特征提取及智能分析技术，该技术在恶意软件检测领域中具有重大意义与实际应用价值。研究内容包括：（1）结合神经网络模型，研究不同处理器架构的二进制文件分类方法；研究字节权重模型进行二进制函数识别，进而提取二进制函数特征。（2）研究调试信息的存储规律，设计精确提取调试信息的算法，结合逆向分析工具，研究调试信息注入技术。 （3）针对API关联性和行为抽取问题，运用关联对象模型，设计算法从流式API调用序列中，将逻辑操作上具有前后联系的API关联起来；研究利用API数据依赖关系图模型作为描述程序高级行为的方法，并设计行为抽取算法。该项目的研究成果为不确定环境下二进制特征提取、恶意软件行为抽取提供了一种新的方法和思路。

二进制分析技术是当前网络空间攻防研究的热点之一，并且传统的二进制分析技术已经不能应对恶意软件的迅猛增长，本项目研究二进制代码特征提取及智能分析技术。项目从ARM固件装载基址判定方法、MIPS固件装载基址判定方法、UEFI固件的攻击面和漏洞分析等方面开展研究。通过研究ARM固件中跳转表的产生原因和编码规律提出一种利用固件中跳转表定位固件装载基址的算法；通过研究LDR指令编码规律和二进制函数加载原理，提出了一种利用LDR指令加载的二进制函数地址判定固件装载基址的方法；通过研究UEFI固件的架构、攻击面，设计并实现了一个UEFI固件全局变量访问工具，为模糊测试奠定了基础。