QuickBCC: Quick and Scalable Binary Vulnerable Code Clone Detection - Inria - Institut national de recherche en sciences et technologies du numérique
Conference Papers Year : 2021

QuickBCC: Quick and Scalable Binary Vulnerable Code Clone Detection

Hajin Jang
  • Function : Author
  • PersonId : 1154379
Kyeongseok Yang
  • Function : Author
  • PersonId : 1154380
Geonwoo Lee
  • Function : Author
  • PersonId : 1154381
Yoonjong Na
  • Function : Author
  • PersonId : 1154382
Jeremy D. Seideman
  • Function : Author
  • PersonId : 1154383
Shoufu Luo
  • Function : Author
  • PersonId : 1154384
Heejo Lee
  • Function : Author
  • PersonId : 989242
Sven Dietrich
  • Function : Author
  • PersonId : 1154385

Abstract

Due to code reuse among software packages, vulnerabilities can propagate from one software package to another. Current code clone detection techniques are useful for preventing and managing such vulnerability propagation. When the source code for a software package is not available, such as when working with proprietary or custom software distributions, binary code clone detection can be used to examine software for flaws. However, existing binary code clone detectors have scalability issues, or are limited in their accurate detection of vulnerable code clones.In this paper, we introduce QuickBCC, a scalable binary code clone detection framework designed for vulnerability scanning. The framework was built on the idea of extracting semantics from vulnerable binaries both before and after security patches, and comparing them to target binaries. In order to improve performance, we created a signature based on the changes between the pre- and post-patched binaries, and implemented a filtering process when comparing the signatures to the target binaries. In addition, we leverage the smallest semantic unit, a strand, to improve accuracy and robustness against compile environments. QuickBCC is highly optimized, capable of preprocessing 5,439 target binaries within 111 min, and is able to match those binaries against 6 signatures in 23 s when running as a multi-threaded application. QuickBCC takes, on average, 3 ms to match one target binary. Comparing performance to other approaches, we found that it outperformed other approaches in terms of performance when detecting well known vulnerabilities with acceptable level of accuracy.
Fichier principal
Vignette du fichier
512098_1_En_5_Chapter.pdf (503.08 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03746026 , version 1 (04-08-2022)

Licence

Identifiers

Cite

Hajin Jang, Kyeongseok Yang, Geonwoo Lee, Yoonjong Na, Jeremy D. Seideman, et al.. QuickBCC: Quick and Scalable Binary Vulnerable Code Clone Detection. 36th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2021, Oslo, Norway. pp.66-82, ⟨10.1007/978-3-030-78120-0_5⟩. ⟨hal-03746026⟩
21 View
22 Download

Altmetric

Share

More