基于二进制相似性分析的重现型漏洞检测方法综述

A survey of recurring vulnerability detection based on binary similarity analysis

摘要:

在软件研发中,复用开源组件与代码模板已经成为主流,这大大降低了开发成本,但若对含有漏洞的代码进行复用,则会导致软件系统中出现重现型漏洞。随着代码复用愈发广泛,其带来的安全问题受到更多的关注,而现有商业软件如IoT固件程序等大多不公开源码与文档,因此需要在二进制层面进行安全研究与检测。近年来,研究人员将二进制相似性分析技术应用至漏洞检测领域,通过识别软件系统中是否存在已知漏洞的二进制代码,实现了对重现型漏洞的高效检测。为此,围绕重现型漏洞检测技术,首先梳理了现有基于二进制相似性分析的方法,并对相关技术进行系统分类与介绍,主要包括基于二进制本身信息进行分析的研究,以及结合相关源码/补丁辅助分析的研究;其次,对现有研究的实验评估数据集、可用工具与基线方法等进行分析总结;最后,在已有研究的基础上,对现存关键技术问题与未来研究方向进行总结与展望。

Abstract:

In the process of software development, the reuse of open-source components and code templates has become mainstream, significantly reducing development costs. However, reusing code with vulnerabilities can lead to the emergence of recurring vulnerabilities in software systems. As code reuse becomes increasingly widespread, the associated security issues it brings are receiving increased attention. Most of the existing commercial softwares, such as IoT firmware programs, often do not publicly disclose their source code or documentation, so security research and detection need to be carried out at the binary level. In recent years, researchers have applied binary code similarity detection technology to the field of vulnerability detection.By identifying whether there are binary codes of known vulnerabilities in software systems, they have achieved efficient detection of recurring vulnerabilities. To this end, this paper first reviewed existing methods based on binary similarity analysis and systematically categorized and introduced related technologies, mainly including research that analyzes binary information itself, as well as studies that combine related source code or patches assisted analysis.Next,it analyzed and summarized experimental evaluation datasets, available tools, and baseline methods from existing research. Finally, it summarized existing key technical issues and looked forward to future research directions.