用图神经网络分析二进制代码语义，识别混淆函数
Identifying Obfuscated Code through Graph-Based Semantic Analysis of Binary Code
- 构建二进制函数的图结构，捕捉语义特征
- 在11类混淆分类中准确率达89.3%，优于传统方法
- 适合恶意软件分析与代码安全检测人员使用
保护程序敏感内容是诸多场景下的关键问题，从合法应用到非法用途均存在。混淆是实现保护的核心技术之一。因此，攻击者需先检测并识别混淆手段才能发动后续攻击。本文研究基于图的方法在函数级混淆检测中的应用，对比了从基础算法到先进模型如GNN（图神经网络）在不同特征选择下的表现。涵盖多种混淆类型与混淆工具，构建了两个复杂数据集。实验表明，仅当使用能反映函数语义的有意义特征时，GNN才能超越基线模型。该方法在具有挑战性的11类分类任务中表现良好，并在实际恶意软件分析案例中验证了有效性。
原文摘要 · Abstract (English)
Protecting sensitive program content is a critical issue in various situations, ranging from legitimate use cases to unethical contexts. Obfuscation is one of the most used techniques to ensure such protection. Consequently, attackers must first detect and characterize obfuscation before launching any attack against it. This paper investigates the problem of function-level obfuscation detection using graph-based approaches, comparing algorithms, from elementary baselines to promising techniques like GNN (Graph Neural Networks), on different feature choices. We consider various obfuscation types and obfuscators, resulting in two complex datasets. Our findings demonstrate that GNNs need meaningful features that capture aspects of function semantics to outperform baselines. Our approach shows satisfactory results, especially in a challenging 11-class classification task and in a practical malware analysis example.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。