Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis - Grenoble Alpes Cybersecurity Institute Access content directly
Conference Papers Year : 2019

Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis

Ramtine Tofighi-Shirazi
  • Function : Author
  • PersonId : 1041018
Irina Mariuca Asavoae
  • Function : Author
  • PersonId : 1054537
Philippe Elbaz-Vincent
Thanh-Ha Le
  • Function : Author

Abstract

We present a new approach that bridges binary analysis techniques with machine learning classification for the purpose of providing a static and generic evaluation technique for opaque predicates, regardless of their constructions. We use this technique as a static automated deobfuscation tool to remove the opaque predicates introduced by obfuscation mechanisms. According to our experimental results, our models have up to 98% accuracy at detecting and deob-fuscating state-of-the-art opaque predicates patterns. By contrast, the leading edge deobfuscation methods based on symbolic execution show less accuracy mostly due to the SMT solvers constraints and the lack of scalability of dynamic symbolic analyses. Our approach underlines the efficiency of hybrid symbolic analysis and machine learning techniques for a static and generic deobfuscation methodology.
Fichier principal
Vignette du fichier
R.Tofighi-Shirazi et al. - Breaking Opaque Predicates Statically through Machine Learning and Binary Analysis - HAL version.pdf (905.08 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-02269192 , version 1 (30-08-2019)

Identifiers

  • HAL Id : hal-02269192 , version 1

Cite

Ramtine Tofighi-Shirazi, Irina Mariuca Asavoae, Philippe Elbaz-Vincent, Thanh-Ha Le. Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis. 3rd International Workshop on Software PROtection, Nov 2019, London, United Kingdom. ⟨hal-02269192⟩
215 View
412 Download

Share

Gmail Facebook X LinkedIn More