用语义引导的Transformer模型，自动还原混淆代码中的布尔-算术表达式。
gMBA: Expression Semantic Guided Mixed Boolean-Arithmetic Deobfuscation Using Transformer Architectures
- 构建无需外部资源的真值表，表征表达式内部语义行为。
- 在真实样本上，语义引导使去混淆准确率显著提升。
- 适合安全研究、恶意代码分析与自动化逆向工程场景。
混合布尔-算术（MBA）混淆通过将程序转化为更难分析的形式来保护知识产权，但正被恶意软件开发者广泛用于逃避检测并造成严重现实问题。传统去混淆方法常将这些表达式视为黑盒，忽略其内部语义信息。为此，本文提出一种自动构建的真值表，作为表达式行为的数学表示，不依赖外部资源；该真值表可穷举所有输入组合下的输出结果。我们进一步设计了一个通用且可扩展的语义引导去混淆框架gMBA，通过修改基于Transformer的序列到序列神经编码器-解码器结构，引入该语义引导机制。实验结果与深入分析表明，融入表达式语义显著提升了去混淆性能，凸显了内部语义信息在恢复混淆代码原始形态中的关键作用。
原文摘要 · Abstract (English)
Mixed Boolean-Arithmetic (MBA) obfuscation protects intellectual property by converting programs into forms that are more complex to analyze. However, MBA has been increasingly exploited by malware developers to evade detection and cause significant real-world problems. Traditional MBA deobfuscation methods often consider these expressions as part of a black box and overlook their internal semantic information. To bridge this gap, we propose a truth table, which is an automatically constructed semantic representation of an expression's behavior that does not rely on external resources. The truth table is a mathematical form that represents the output of expression for all possible combinations of input. We also propose a general and extensible guided MBA deobfuscation framework (gMBA) that modifies a Transformer-based neural encoder-decoder Seq2Seq architecture to incorporate this semantic guidance. Experimental results and in-depth analysis show that integrating expression semantics significantly improves performance and highlights the importance of internal semantic expressions in recovering obfuscated code to its original form.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。