BitBlaze: A New Approach to Computer Security via Binary Analysis

Authors:
Dawn Song;David Brumley;Heng Yin;Juan Caballero;Ivan Jager;Min Gyung Kang;Zhenkai Liang;James Newsome;Pongsin Poosankam;Prateek Saxena
Affiliations:
UC Berkeley,;Carnegie Mellon University,;UC Berkeley, and Carnegie Mellon University, and College of William and Mary,;UC Berkeley, and Carnegie Mellon University,;Carnegie Mellon University,;UC Berkeley, and Carnegie Mellon University,;Carnegie Mellon University,;Carnegie Mellon University,;UC Berkeley, and Carnegie Mellon University,;UC Berkeley,
Venue:
ICISS '08 Proceedings of the 4th International Conference on Information Systems Security
Year:
2008

Citing 22
Cited 69

Advanced compiler design and implementation

Advanced compiler design and implementation
A Discipline of Programming

A Discipline of Programming
Chopping: A Generalization of Slicing

Chopping: A Generalization of Slicing
Value-driven redundancy elimination

Value-driven redundancy elimination
Secure program execution via dynamic information flow tracking

ASPLOS XI Proceedings of the 11th international conference on Architectural support for programming languages and operating systems
Minos: Control Data Attack Prevention Orthogonal to Memory Model

Proceedings of the 37th annual IEEE/ACM International Symposium on Microarchitecture
Pin: building customized program analysis tools with dynamic instrumentation

Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation
Vigilante: end-to-end containment of internet worms

Proceedings of the twentieth ACM symposium on Operating systems principles
Towards Automatic Generation of Vulnerability-Based Signatures

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Replayer: automatic protocol replay by binary analysis

Proceedings of the 13th ACM conference on Computer and communications security
Static disassembly of obfuscated binaries

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Understanding data lifetime via whole system simulation

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Creating Vulnerability Signatures Using Weakest Preconditions

CSF '07 Proceedings of the 20th IEEE Computer Security Foundations Symposium
Sweeper: a lightweight end-to-end system for defending against fast worms

Proceedings of the 2nd ACM SIGOPS/EuroSys European Conference on Computer Systems 2007
Renovo: a hidden code extractor for packed executables

Proceedings of the 2007 ACM workshop on Recurring malcode
Panorama: capturing system-wide information flow for malware detection and analysis

Proceedings of the 14th ACM conference on Computer and communications security
Polyglot: automatic extraction of protocol message format using dynamic binary analysis

Proceedings of the 14th ACM conference on Computer and communications security
Wysinwyx: what you see is not what you execute

Wysinwyx: what you see is not what you execute
Towards automatic discovery of deviations in binary implementations with applications to error detection and fingerprint generation

SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications

SP '08 Proceedings of the 2008 IEEE Symposium on Security and Privacy
A decision procedure for bit-vectors and arrays

CAV'07 Proceedings of the 19th international conference on Computer aided verification
CodeSurfer/x86—A platform for analyzing x86 executables

CC'05 Proceedings of the 14th international conference on Compiler Construction

Towards Generating High Coverage Vulnerability-Based Signatures with Protocol-Level Constraint-Guided Exploration

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
Test generation to expose changes in evolving programs

Proceedings of the IEEE/ACM international conference on Automated software engineering
Input generation via decomposition and re-stitching: finding bugs in Malware

Proceedings of the 17th ACM conference on Computer and communications security
Cost-aware systemwide intrusion defense via online forensics and on-demand detector deployment

Proceedings of the 3rd ACM workshop on Assurable and usable security configuration
Hardware trust implications of 3-D integration

WESS '10 Proceedings of the 5th Workshop on Embedded Systems Security
Golden implementation driven software debugging

Proceedings of the eighteenth ACM SIGSOFT international symposium on Foundations of software engineering
From NLP (natural language processing) to MLP (machine language processing)

MMM-ACNS'10 Proceedings of the 5th international conference on Mathematical methods, models and architectures for computer network security
On challenges in evaluating malware clustering

RAID'10 Proceedings of the 13th international conference on Recent advances in intrusion detection
Toward whole-system dynamic analysis for ARM-based mobile devices

RAID'10 Proceedings of the 13th international conference on Recent advances in intrusion detection
A design for comprehensive kernel instrumentation

HotDep'10 Proceedings of the Sixth international conference on Hot topics in system dependability
Efficient symbolic execution for analysing cryptographic protocol implementations

ESSoS'11 Proceedings of the Third international conference on Engineering secure software and systems
S2E: a platform for in-vivo multi-path analysis of software systems

Proceedings of the sixteenth international conference on Architectural support for programming languages and operating systems
ICE: circumventing meltdown with an advanced binary analysis framework

Proceedings of the 1st Workshop on Developing Tools as Plug-ins
Statically-directed dynamic automated test generation

Proceedings of the 2011 International Symposium on Software Testing and Analysis
Take two software updates and see me in the morning: the case for software security evaluations of medical devices

HealthSec'11 Proceedings of the 2nd USENIX conference on Health security and privacy
JACKSTRAWS: picking command and control connections from bot traffic

SEC'11 Proceedings of the 20th USENIX conference on Security
Side-effect analysis of assembly code

SAS'11 Proceedings of the 18th international conference on Static analysis
Floguard: cost-aware systemwide intrusion defense via online forensics and on-demand IDS deployment

SAFECOMP'11 Proceedings of the 30th international conference on Computer safety, reliability, and security
Combining control-flow integrity and static analysis for efficient and validated data sandboxing

Proceedings of the 18th ACM conference on Computer and communications security
The power of procrastination: detection and mitigation of execution-stalling malicious code

Proceedings of the 18th ACM conference on Computer and communications security
Synthesizing method sequences for high-coverage testing

Proceedings of the 2011 ACM international conference on Object oriented programming systems languages and applications
The science of cyber security experimentation: the DETER project

Proceedings of the 27th Annual Computer Security Applications Conference
Static program analysis assisted dynamic taint tracking for software vulnerability discovery

Computers & Mathematics with Applications
The S2E Platform: Design, Implementation, and Applications

ACM Transactions on Computer Systems (TOCS) - Special Issue APLOS 2011
Identifying native applications with high assurance

Proceedings of the second ACM conference on Data and Application Security and Privacy
Comprehensive kernel instrumentation via dynamic binary translation

ASPLOS XVII Proceedings of the seventeenth international conference on Architectural Support for Programming Languages and Operating Systems
Path-exploration lifting: hi-fi tests for lo-fi emulators

ASPLOS XVII Proceedings of the seventeenth international conference on Architectural Support for Programming Languages and Operating Systems
Execution mining

VEE '12 Proceedings of the 8th ACM SIGPLAN/SIGOPS conference on Virtual Execution Environments
Using purpose capturing signatures to defeat computer virus mutating

ISPEC'10 Proceedings of the 6th international conference on Information Security Practice and Experience
Efficient and stealthy instruction tracing and its applications in automated malware analysis: open problems and challenges

iNetSec'11 Proceedings of the 2011 IFIP WG 11.4 international conference on Open Problems in Network Security
Alternating control flow reconstruction

VMCAI'12 Proceedings of the 13th international conference on Verification, Model Checking, and Abstract Interpretation
DARWIN: An approach to debugging evolving programs

ACM Transactions on Software Engineering and Methodology (TOSEM)
Tracking DDoS attacks: insights into the business of disrupting the web

LEET'12 Proceedings of the 5th USENIX conference on Large-Scale Exploits and Emergent Threats
Automated synthesis of symbolic instruction encodings from I/O samples

Proceedings of the 33rd ACM SIGPLAN conference on Programming Language Design and Implementation
Static detection of unsafe component loadings

CC'12 Proceedings of the 21st international conference on Compiler Construction
make test-zesti: a symbolic execution solution for improving regression testing

Proceedings of the 34th International Conference on Software Engineering
Holography: a behavior-based profiler for malware analysis

Software—Practice & Experience
Practical isolation of failure-inducing changes for debugging regression faults

Proceedings of the 27th IEEE/ACM International Conference on Automated Software Engineering
SMT solvers for software security

WOOT'12 Proceedings of the 6th USENIX conference on Offensive Technologies
Improving malware classification: bridging the static/dynamic gap

Proceedings of the 5th ACM workshop on Security and artificial intelligence
A software-hardware architecture for self-protecting data

Proceedings of the 2012 ACM conference on Computer and communications security
SymDrive: testing drivers without devices

OSDI'12 Proceedings of the 10th USENIX conference on Operating Systems Design and Implementation
Learning fine-grained structured input for memory corruption detection

ISC'12 Proceedings of the 15th international conference on Information Security
BotFinder: finding bots in network traffic without deep packet inspection

Proceedings of the 8th international conference on Emerging networking experiments and technologies
Using memory management to detect and extract illegitimate code for malware analysis

Proceedings of the 28th Annual Computer Security Applications Conference
Down to the bare metal: using processor features for binary analysis

Proceedings of the 28th Annual Computer Security Applications Conference
Augmenting vulnerability analysis of binary code

Proceedings of the 28th Annual Computer Security Applications Conference
Kernel mode API spectroscopy for incident response and digital forensics

PPREW '13 Proceedings of the 2nd ACM SIGPLAN Program Protection and Reverse Engineering Workshop
Detecting control flow in smarphones: combining static and dynamic analyses

CSS'12 Proceedings of the 4th international conference on Cyberspace Safety and Security
TSL: A System for Generating Abstract Interpreters and its Application to Machine-Code Analysis

ACM Transactions on Programming Languages and Systems (TOPLAS)
Architecture-Independent dynamic information flow tracking

CC'13 Proceedings of the 22nd international conference on Compiler Construction
Dissecting SpyEye - Understanding the design of third generation botnets

Computer Networks: The International Journal of Computer and Telecommunications Networking
A compiler-level intermediate representation based binary analysis and rewriting system

Proceedings of the 8th ACM European Conference on Computer Systems
A survey of security issues in hardware virtualization

ACM Computing Surveys (CSUR)
iBinHunt: binary hunting with inter-procedural control flow

ICISC'12 Proceedings of the 15th international conference on Information Security and Cryptology
Abstract interpretation of microcontroller code: Intervals meet congruences

Science of Computer Programming
State of the art: Dynamic symbolic execution for automated test generation

Future Generation Computer Systems
Data flow analysis of embedded program expressions

AISC '12 Proceedings of the Tenth Australasian Information Security Conference - Volume 125
Tappan Zee (north) bridge: mining memory accesses for introspection

Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
Proceedings of the Twenty-Fourth ACM Symposium on Operating Systems Principles

ACM SIGOPS 24th Symposium on Operating Systems Principles
Fast dynamic binary translation for the kernel

Proceedings of the Twenty-Fourth ACM Symposium on Operating Systems Principles
Path exploration based on symbolic output

ACM Transactions on Software Engineering and Methodology (TOSEM) - Testing, debugging, and error handling, formal methods, lifecycle concerns, evolution and maintenance
SPIDER: stealthy binary program instrumentation and debugging via hardware virtualization

Proceedings of the 29th Annual Computer Security Applications Conference
MAIL: Malware Analysis Intermediate Language: a step towards automating and optimizing malware detection

Proceedings of the 6th International Conference on Security of Information and Networks
MetaSymploit: day-one defense against script-based attacks with security-enhanced symbolic analysis

SEC'13 Proceedings of the 22nd USENIX conference on Security
Prototyping symbolic execution engines for interpreted languages

Proceedings of the 19th international conference on Architectural support for programming languages and operating systems
A distributed framework for demand-driven software vulnerability detection

Journal of Systems and Software
A platform for secure static binary instrumentation

Proceedings of the 10th ACM SIGPLAN/SIGOPS international conference on Virtual execution environments
Light-weight kernel instrumentation framework using dynamic binary translation

The Journal of Supercomputing

Quantified Score

Hi-index	0.00

Visualization

Abstract

In this paper, we give an overview of the BitBlaze project, a new approach to computer security via binary analysis. In particular, BitBlaze focuses on building a unified binary analysis platform and using it to provide novel solutions to a broad spectrum of different security problems. The binary analysis platform is designed to enable accurate analysis, provide an extensible architecture, and combines static and dynamic analysis as well as program verification techniques to satisfy the common needs of security applications. By extracting security-related properties from binary programs directly, BitBlaze enables a principled, root-cause based approach to computer security, offering novel and effective solutions, as demonstrated with over a dozen different security applications.