Version 1
: Received: 5 September 2022 / Approved: 5 September 2022 / Online: 5 September 2022 (07:10:33 CEST)
Version 2
: Received: 23 September 2022 / Approved: 23 September 2022 / Online: 23 September 2022 (08:24:19 CEST)
Tang, K.; Shan, Z.; Zhang, C.; Xu, L.; Qiao, M.; Liu, F. DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network. Electronics2022, 11, 3230.
Tang, K.; Shan, Z.; Zhang, C.; Xu, L.; Qiao, M.; Liu, F. DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network. Electronics 2022, 11, 3230.
Tang, K.; Shan, Z.; Zhang, C.; Xu, L.; Qiao, M.; Liu, F. DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network. Electronics2022, 11, 3230.
Tang, K.; Shan, Z.; Zhang, C.; Xu, L.; Qiao, M.; Liu, F. DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network. Electronics 2022, 11, 3230.
Abstract
Obfuscation techniques have become complex and diverse, and while they play a crucial role in software copyright protection, they also help produce numerous malware variants that evade antivirus software. Automatic detection of malware is inseparable from binary code similarity detection technology. However, the existing code detection methods are difficult to cope with the increasingly complex obfuscation techniques. Therefore, in this paper, we propose a method combining data flow relationships and neural network to analyze obfuscated code for the first time. In our approach, we first construct the data transformation graph based on LLVM IR. Then, we design a novel intermediate language representation model based on graph neural network, named DFSGraph, to learn the data flow semantic from DTG. Through extensive experiments on obfuscated dataset, it is proved that our method can extract the semantic information of obfuscated code well. And it can achieve surprising results in binary code similarity detection task and obfuscation technique classification task. Our method provides an idea for further research on deobfuscation techniques.
Computer Science and Mathematics, Computer Vision and Graphics
Copyright:
This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
