ISAdetect : Usable Automated Detection of CPU Architecture and Endianness for Executable Binary Files and Object Code
Kairajärvi, S., Costin, A., & Hämäläinen, T. (2020). ISAdetect : Usable Automated Detection of CPU Architecture and Endianness for Executable Binary Files and Object Code. In CODASPY '20 : Proceedings of the 10th ACM Conference on Data and Application Security and Privacy (pp. 376-380). ACM. https://doi.org/10.1145/3374664.3375742
Date
2020Copyright
© 2020 ACM
Static and dynamic binary analysis techniques are actively used to reverse engineer software's behavior and to detect its vulnerabilities, even when only the binary code is available for analysis. To avoid analysis errors due to misreading op-codes for a wrong CPU architecture, these analysis tools must precisely identify the Instruction Set Architecture (ISA) of the object code under analysis. The variety of CPU architectures that modern security and reverse engineering tools must support is ever increasing due to massive proliferation of IoT devices and the diversity of firmware and malware targeting those devices. Recent studies concluded that falsely identifying the binary code's ISA caused alone about 10% of failures of IoT firmware analysis. The state of the art approaches detecting ISA for executable object code look promising, and their results demonstrate effectiveness and high-performance. However, they lack the support of publicly available datasets and toolsets, which makes the evaluation, comparison, and improvement of those techniques, datasets, and machine learning models quite challenging (if not impossible). This paper bridges multiple gaps in the field of automated and precise identification of architecture and endianness of binary files and object code. We develop from scratch the toolset and datasets that are lacking in this research space. As such, we contribute a comprehensive collection of open data, open source, and open API web-services. We also attempt experiment reconstruction and cross-validation of effectiveness, efficiency, and results of the state of the art methods. When training and testing classifiers using solely code-sections from executable binary files, all our classifiers performed equally well achieving over 98% accuracy. The results are consistent and comparable with the current state of the art, hence supports the general validity of the algorithms, features, and approaches suggested in those works.
...
![showless](/themes/JYX2//images/showless.png)
![showmore](/themes/JYX2//images/showmore.png)
Publisher
ACMParent publication ISBN
978-1-4503-7107-0Conference
ACM Conference on Data and Applications Security and PrivacyIs part of publication
CODASPY '20 : Proceedings of the 10th ACM Conference on Data and Application Security and PrivacyPublication in research information system
https://converis.jyu.fi/converis/portal/detail/Publication/35068275
Metadata
Show full item recordCollections
Related funder(s)
Business FinlandFunding program(s)
Research to Business (R2B), BFAdditional information about funding
Authors would like to acknowledge BINARE.IO [1] and APPIOTS (Business Finland project 1758/31/2018), as well as the grants of computer capacity from the Finnish Grid and Cloud Infrastructure (FGCI) (http:// urn./ urn:nbn::research-infras-2016072533).License
Related items
Showing items with similar title or keywords.
-
Architecture-independent matching of stripped binary code files using BERT and a Siamese neural network
Lampinen, Kenneth (2020)The proliferation of IoT devices brings many cyber security challenges. Identifying executable code with known vulnerabilities is one of them, this despite the fact that open source code is commonly used in IoT firmware. ... -
IoT-verkon tietoturvauhat ja niiden estäminen
Hämäläinen, Toni (2020)Tässä tutkielmassa tutustutaan IoT-verkkoon kohdistuviin hyökkäyksiin, sekä tapoihin joilla suojautua niiltä. Tutkielman tavoitteena on kartoittaa tapoja joilla IoT-verkko voidaan toteuttaa turvallisesti tietoturvan ja ... -
Miten tietoisuus älylaitteiden tietoturvauhkista vaikuttaa älylaitteiden käyttöön
Koskinen, Ida (2020)Tämän tutkielman tarkoituksena oli tutkia sitä, miten tietoisuus älylaitteiden tietoturvauhkista vaikuttaa älylaitteiden käyttöön ja tietoturvauhkilta suojautumiseen. Älylaitteet lisääntyvät jatkuvasti esineiden internetin ... -
Laitteiston tietoturva 5G-verkoissa
Paju, Ville (2020)Tässä tutkimuksessa verrataan 5G-yhteyksien tietoturvaominaisuuksia jo olemassaolevien langattomien tiedonsiirtoteknologioiden kanssa, sekä tarkastellaan 5G-yhteyksienominaisuuksien myötä ilmeneviä tietoturvaan liittyviä seikkoja. -
Esineiden internet ja sen tietoturva sovelluskerroksella
Lahtinen, Tuomo (2019)IoT on tulevaisuuden internet, joka on kaikkialla ympärillämme. Se avaa lukuisia mahdollisuuksia, mutta toisaalta sen valtaisa kasvu on myös synnyttänyt riskejä, joita ihmisten tulisi arvioida. IoT sisältää kerroksia ja ...