BinVulDet: Detecting vulnerability in binary program via decompiled pseudo code and BiLSTM-attention. Issue 125 (February 2023)

• Record Type: Journal Article
• Authors: Wang, Yan; Jia, Peng; Peng, Xi; Huang, Cheng; Liu, Jiayong
• Is Part Of: Computers & security. Issue 125(2023)
• Publication Date: 2023-02
• Subjects: Binary program -- Decompile -- Vulnerability detection -- Program slicing -- BiLSTM-attention; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.103023
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Static detection of security vulnerabilities in binary programs is an important research field in software supply chain security. However, existing vulnerability detection methods based on code similarity can only detect known vulnerabilities. Vulnerability features generated by vulnerability pattern-based detection methods are low robust due to the influence of manually defined patterns, compiler diversity, and irrelevant function instructions. In this paper, we propose BinVulDet, which is a binary level vulnerability detection tool for accurate known and unknown vulnerability detection. BinVulDet uses decompilation techniques to obtain pseudo code containing high-level semantic information against the impact of compilation diversity. Then the program slicing technique is used to extract the statements with data dependencies and control dependencies related to the vulnerability. A BiLSTM-attention neural network is used to extract rich contextual semantic information from slice codes to generate more robust vulnerability patterns to detect vulnerabilities. The experimental results show that BinVulDet outperforms the state-of-the-art binary vulnerability detection methods. The FPR and FNR of BinVulDet are 1.04% and 0.89% on average, respectively, which are 3.93% and 22.86% lower than the baseline model on average. BinVulDet can effectively against the influence of compilation diversity and successfully be used for real-world vulnerability detection by being evaluated in three CVE vulnerability projects.