Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis

We present a new approach that bridges binary analysis techniques with machine learning classification for the purpose of providing a static and generic evaluation technique for opaque predicates, regardless of their constructions. We use this technique as a static automated deobfuscation tool to re...

Full description

Saved in:
Bibliographic Details
Published in:arXiv.org 2019-09
Main Authors: Tofighi-Shirazi, Ramtine, Asăvoae, Irina, Elbaz-Vincent, Philippe, Thanh-Ha, Le
Format: Article
Language:English
Subjects:
Artificial intelligence
Machine learning
Model accuracy
Solvers
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
cited_by
cites
container_end_page
container_issue
container_start_page
container_title arXiv.org
container_volume
creator Tofighi-Shirazi, Ramtine
Asăvoae, Irina
Elbaz-Vincent, Philippe
Thanh-Ha, Le
description We present a new approach that bridges binary analysis techniques with machine learning classification for the purpose of providing a static and generic evaluation technique for opaque predicates, regardless of their constructions. We use this technique as a static automated deobfuscation tool to remove the opaque predicates introduced by obfuscation mechanisms. According to our experimental results, our models have up to 98% accuracy at detecting and deob-fuscating state-of-the-art opaque predicates patterns. By contrast, the leading edge deobfuscation methods based on symbolic execution show less accuracy mostly due to the SMT solvers constraints and the lack of scalability of dynamic symbolic analyses. Our approach underlines the efficiency of hybrid symbolic analysis and machine learning techniques for a static and generic deobfuscation methodology.
format article
fullrecord <record><control><sourceid>proquest</sourceid><recordid>TN_cdi_proquest_journals_2284877363</recordid><sourceformat>XML</sourceformat><sourcesystem>PC</sourcesystem><sourcerecordid>2284877363</sourcerecordid><originalsourceid>FETCH-proquest_journals_22848773633</originalsourceid><addsrcrecordid>eNqNjc0KgkAURocgSMp3GGgt2Ix_235pURTYXi561ZFhtLnjwrfPoAdodRbf-TgL5gkpd0EWCbFiPlEXhqFIUhHH0mP5CWsEp0zDHwO8R-RPi5UqwSHx3M1LCVpP3LW2H5uW36FslUF-Q7Dm-wJT8YMyYCe-N6AnUrRhyxo0of_jmm0v59fxGgy2nwvkiq4f7SxTIUQWZWkqEyn_sz4-MEAu</addsrcrecordid><sourcetype>Aggregation Database</sourcetype><iscdi>true</iscdi><recordtype>article</recordtype><pqid>2284877363</pqid></control><display><type>article</type><title>Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis</title><source>ProQuest - Publicly Available Content Database</source><creator>Tofighi-Shirazi, Ramtine ; Asăvoae, Irina ; Elbaz-Vincent, Philippe ; Thanh-Ha, Le</creator><creatorcontrib>Tofighi-Shirazi, Ramtine ; Asăvoae, Irina ; Elbaz-Vincent, Philippe ; Thanh-Ha, Le</creatorcontrib><description>We present a new approach that bridges binary analysis techniques with machine learning classification for the purpose of providing a static and generic evaluation technique for opaque predicates, regardless of their constructions. We use this technique as a static automated deobfuscation tool to remove the opaque predicates introduced by obfuscation mechanisms. According to our experimental results, our models have up to 98% accuracy at detecting and deob-fuscating state-of-the-art opaque predicates patterns. By contrast, the leading edge deobfuscation methods based on symbolic execution show less accuracy mostly due to the SMT solvers constraints and the lack of scalability of dynamic symbolic analyses. Our approach underlines the efficiency of hybrid symbolic analysis and machine learning techniques for a static and generic deobfuscation methodology.</description><identifier>EISSN: 2331-8422</identifier><language>eng</language><publisher>Ithaca: Cornell University Library, arXiv.org</publisher><subject>Artificial intelligence ; Machine learning ; Model accuracy ; Solvers</subject><ispartof>arXiv.org, 2019-09</ispartof><rights>2019. This work is published under http://arxiv.org/licenses/nonexclusive-distrib/1.0/ (the “License”). Notwithstanding the ProQuest Terms and Conditions, you may use this content in accordance with the terms of the License.</rights><oa>free_for_read</oa><woscitedreferencessubscribed>false</woscitedreferencessubscribed></display><links><openurl>$$Topenurl_article</openurl><openurlfulltext>$$Topenurlfull_article</openurlfulltext><thumbnail>$$Tsyndetics_thumb_exl</thumbnail><linktohtml>$$Uhttps://www.proquest.com/docview/2284877363?pq-origsite=primo$$EHTML$$P50$$Gproquest$$Hfree_for_read</linktohtml><link.rule.ids>780,784,25753,37012,44590</link.rule.ids></links><search><creatorcontrib>Tofighi-Shirazi, Ramtine</creatorcontrib><creatorcontrib>Asăvoae, Irina</creatorcontrib><creatorcontrib>Elbaz-Vincent, Philippe</creatorcontrib><creatorcontrib>Thanh-Ha, Le</creatorcontrib><title>Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis</title><title>arXiv.org</title><description>We present a new approach that bridges binary analysis techniques with machine learning classification for the purpose of providing a static and generic evaluation technique for opaque predicates, regardless of their constructions. We use this technique as a static automated deobfuscation tool to remove the opaque predicates introduced by obfuscation mechanisms. According to our experimental results, our models have up to 98% accuracy at detecting and deob-fuscating state-of-the-art opaque predicates patterns. By contrast, the leading edge deobfuscation methods based on symbolic execution show less accuracy mostly due to the SMT solvers constraints and the lack of scalability of dynamic symbolic analyses. Our approach underlines the efficiency of hybrid symbolic analysis and machine learning techniques for a static and generic deobfuscation methodology.</description><subject>Artificial intelligence</subject><subject>Machine learning</subject><subject>Model accuracy</subject><subject>Solvers</subject><issn>2331-8422</issn><fulltext>true</fulltext><rsrctype>article</rsrctype><creationdate>2019</creationdate><recordtype>article</recordtype><sourceid>PIMPY</sourceid><recordid>eNqNjc0KgkAURocgSMp3GGgt2Ix_235pURTYXi561ZFhtLnjwrfPoAdodRbf-TgL5gkpd0EWCbFiPlEXhqFIUhHH0mP5CWsEp0zDHwO8R-RPi5UqwSHx3M1LCVpP3LW2H5uW36FslUF-Q7Dm-wJT8YMyYCe-N6AnUrRhyxo0of_jmm0v59fxGgy2nwvkiq4f7SxTIUQWZWkqEyn_sz4-MEAu</recordid><startdate>20190904</startdate><enddate>20190904</enddate><creator>Tofighi-Shirazi, Ramtine</creator><creator>Asăvoae, Irina</creator><creator>Elbaz-Vincent, Philippe</creator><creator>Thanh-Ha, Le</creator><general>Cornell University Library, arXiv.org</general><scope>8FE</scope><scope>8FG</scope><scope>ABJCF</scope><scope>ABUWG</scope><scope>AFKRA</scope><scope>AZQEC</scope><scope>BENPR</scope><scope>BGLVJ</scope><scope>CCPQU</scope><scope>DWQXO</scope><scope>HCIFZ</scope><scope>L6V</scope><scope>M7S</scope><scope>PIMPY</scope><scope>PQEST</scope><scope>PQQKQ</scope><scope>PQUKI</scope><scope>PRINS</scope><scope>PTHSS</scope></search><sort><creationdate>20190904</creationdate><title>Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis</title><author>Tofighi-Shirazi, Ramtine ; Asăvoae, Irina ; Elbaz-Vincent, Philippe ; Thanh-Ha, Le</author></sort><facets><frbrtype>5</frbrtype><frbrgroupid>cdi_FETCH-proquest_journals_22848773633</frbrgroupid><rsrctype>articles</rsrctype><prefilter>articles</prefilter><language>eng</language><creationdate>2019</creationdate><topic>Artificial intelligence</topic><topic>Machine learning</topic><topic>Model accuracy</topic><topic>Solvers</topic><toplevel>online_resources</toplevel><creatorcontrib>Tofighi-Shirazi, Ramtine</creatorcontrib><creatorcontrib>Asăvoae, Irina</creatorcontrib><creatorcontrib>Elbaz-Vincent, Philippe</creatorcontrib><creatorcontrib>Thanh-Ha, Le</creatorcontrib><collection>ProQuest SciTech Collection</collection><collection>ProQuest Technology Collection</collection><collection>Materials Science &amp; Engineering Collection</collection><collection>ProQuest Central (Alumni)</collection><collection>ProQuest Central</collection><collection>ProQuest Central Essentials</collection><collection>ProQuest Central</collection><collection>Technology Collection</collection><collection>ProQuest One Community College</collection><collection>ProQuest Central Korea</collection><collection>SciTech Premium Collection</collection><collection>ProQuest Engineering Collection</collection><collection>Engineering Database</collection><collection>ProQuest - Publicly Available Content Database</collection><collection>ProQuest One Academic Eastern Edition (DO NOT USE)</collection><collection>ProQuest One Academic</collection><collection>ProQuest One Academic UKI Edition</collection><collection>ProQuest Central China</collection><collection>Engineering collection</collection></facets><delivery><delcategory>Remote Search Resource</delcategory><fulltext>fulltext</fulltext></delivery><addata><au>Tofighi-Shirazi, Ramtine</au><au>Asăvoae, Irina</au><au>Elbaz-Vincent, Philippe</au><au>Thanh-Ha, Le</au><format>book</format><genre>document</genre><ristype>GEN</ristype><atitle>Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis</atitle><jtitle>arXiv.org</jtitle><date>2019-09-04</date><risdate>2019</risdate><eissn>2331-8422</eissn><abstract>We present a new approach that bridges binary analysis techniques with machine learning classification for the purpose of providing a static and generic evaluation technique for opaque predicates, regardless of their constructions. We use this technique as a static automated deobfuscation tool to remove the opaque predicates introduced by obfuscation mechanisms. According to our experimental results, our models have up to 98% accuracy at detecting and deob-fuscating state-of-the-art opaque predicates patterns. By contrast, the leading edge deobfuscation methods based on symbolic execution show less accuracy mostly due to the SMT solvers constraints and the lack of scalability of dynamic symbolic analyses. Our approach underlines the efficiency of hybrid symbolic analysis and machine learning techniques for a static and generic deobfuscation methodology.</abstract><cop>Ithaca</cop><pub>Cornell University Library, arXiv.org</pub><oa>free_for_read</oa></addata></record>
fulltext fulltext
identifier EISSN: 2331-8422
ispartof arXiv.org, 2019-09
issn 2331-8422
language eng
recordid cdi_proquest_journals_2284877363
source ProQuest - Publicly Available Content Database
subjects Artificial intelligence
Machine learning
Model accuracy
Solvers
title Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis
url http://sfxeu10.hosted.exlibrisgroup.com/loughborough?ctx_ver=Z39.88-2004&ctx_enc=info:ofi/enc:UTF-8&ctx_tim=2025-01-01T08%3A22%3A48IST&url_ver=Z39.88-2004&url_ctx_fmt=infofi/fmt:kev:mtx:ctx&rfr_id=info:sid/primo.exlibrisgroup.com:primo3-Article-proquest&rft_val_fmt=info:ofi/fmt:kev:mtx:book&rft.genre=document&rft.atitle=Defeating%20Opaque%20Predicates%20Statically%20through%20Machine%20Learning%20and%20Binary%20Analysis&rft.jtitle=arXiv.org&rft.au=Tofighi-Shirazi,%20Ramtine&rft.date=2019-09-04&rft.eissn=2331-8422&rft_id=info:doi/&rft_dat=%3Cproquest%3E2284877363%3C/proquest%3E%3Cgrp_id%3Ecdi_FETCH-proquest_journals_22848773633%3C/grp_id%3E%3Coa%3E%3C/oa%3E%3Curl%3E%3C/url%3E&rft_id=info:oai/&rft_pqid=2284877363&rft_id=info:pmid/&rfr_iscdi=true