Semantic and graph analysis improves vulnerability detection in assembly code
SEMA-GUARD: Semantic and Graph-Based Vulnerability Detection in Assembly Code
Cryptography and Security
Summary
Finding security problems in software is harder when only the low-level assembly code is available, such as in malware or device firmware. The authors created a method called SEMA-GUARD that looks at how the program actually works, including details like memory use and data flow, rather than just its structure. Their method uses special neural networks that work on graphs representing the program's flow, enhanced with semantic info. Tested on a set of programs converted to assembly, their approach detected vulnerabilities with about 85% accuracy. This suggests that combining semantic details with graph techniques helps find flaws in compiled programs.
What this means in practice
- •For malware analysts: Identify potential security flaws in malware binaries when source code is unavailable by analyzing assembly-level semantics and graph structures.
- •For firmware security teams: Detect vulnerabilities in embedded system firmware by examining low-level code execution patterns without needing source code.
Authors
Halil Dursunoglu, Kaan Sulkalar
Abstract
In cases where source code is not available, such as malware analysis, firmware analysis, and embedded systems analysis, vulnerability detection in compiled programs has gained importance. Current methods are heavily reliant on syntactical regularities or higher level representations that are vulnerable to changes in the compiler and may not be readily applicable to assembly code.In this article, we present SEMA-GUARD, a framework that uses semantic analysis and graph neural networks to identify flaws in assembly code. The approach improves the representation of control flow graphs by adding information about the program's execution at a lower level of abstraction, including stack manipulations, memory accesses, and data flow. A set based on the Juliet Test Suite was used to evaluate the effectiveness of SEMA-GUARD. In this set, each piece of source code is initially translated into assembly language and then broken down into function-level chunks. The suggested method, which relies only on statistical or structural data, achieves an accuracy of 85.1\% and an F1 score of 0.801, according to the results. Such results imply that including semantic information in graph-based models may be a successful method for identifying vulnerabilities in compiled code.