Predicting the Resilience of Obfuscated Code...
summary
A machine-learned regressor estimates how long a symbolic-execution attack takes by training on a random C generator that produces 4,608 functions, obfuscating them with Tigress into over 23,000+ obfuscated binaries, and recording symbolic-execution times using KLEE/STP. Sixty-four features are extracted and pruned to 15 top predictors (13 are SAT-derived); SAT-graph community structure is most predictive. A random-forest-style model predicts deobfuscation time with >90% accuracy for ~80% of samples, and generalizes reasonably to real hash functions (up to ~4.5× error on hard SAT instances).
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:56Motivation
- 4:43Overview of Methodology Steps
- 5:34Symbolic Execution in a Nutshell
- 8:04Create Date of Original Programs
- 9:40cont) C Program Generator
- 11:31Obfuscate Programs
- 12:30Attack Obfuscated Programs
- 12:46Feature Extraction
- 15:08Create Prediction Model for Deobfuscation TUT
- 19:36Generality of Results cont
- 23:35Thank you for your attention
related talks
45m"Advanced Malware Threat: handling obfuscated code using..."
26mAn Effective Approach to Software Obfuscation
47mJavaScript Obfuscation: It’s All About the P a c k e r s
23mNext-Generation of Exploit Kit Detection By Building Simulated Obfuscators
35mEnhancing Software Composition Analysis Resilience Against Container Image Obfuscation
23mSecurity Outgunned: Measuring Software Defined Attack Surface
21mWhen Obfuscations Preserve Cryptographic Constant-Time
25mTowards Cognitive Obfuscation