Mixed Boolean Arithmetic (MBA) obfuscation transforms a program expression into an equivalent but complex expression that is hard to understand. MBA obfuscation has been popular to protect programs from reverse engineering thanks to its simplicity and effectiveness. However, it is also used for evading malware detection, necessitating the development of effective MBA deobfuscation techniques. Existing deobfuscation methods suffer from one or more of four limitations: (1) lack of general applicability, (2) lack of flexibility, (3) lack of scalability, and (4) lack of correctness. In this paper, we propose a versatile MBA deobfuscation method that synergistically combines program synthesis, term rewriting, and an algebraic simplification method. The key novelty of our approach is that we perform on-the-fly learning of transformation rules for deobfuscation, and apply them to rewrite the input MBA expression. We implement our method in a tool called ProMBA and evaluate it on over 4000 MBA expressions obfuscated by the state-of-the-art obfuscation tools. Experimental results show that our method outperforms the state-of-the-art MBA deobfuscation tool by a large margin, successfully simplifying a vast majority of the obfuscated expressions into their original forms.

Identifying obfuscation techniques is essential for effective malware analysis and mitigation. Previous research has primarily focused on x86 architectures, but obfuscation techniques have become increasingly prevalent in IoT malware, particularly on ARM and MIPS architectures.This paper presents a method for identifying obfuscation techniques across different architectures. We first analyze and enhance an existing approach for x86 malware, improving its accuracy and efficiency. We then extend the method to IoT architectures, evaluating how architectural differences influence obfuscation patterns. Experimental results confirm that the proposed method effectively detects obfuscation techniques across multiple platforms, providing a foundation for more robust malware analysis in IoT environments. This research strengthens security measures by enabling more effective deobfuscation strategies against emerging threats.

Program obfuscation transforms source code into a complex, harder-to-analyze form while preserving functionality, commonly used for intellectual property protection and security. Although it is also exploited by malware developers. Opaque predicate obfuscation increases program size by inserting junk code with conditional expressions that prevent execution. Existing deobfuscation methods rely on symbolic execution and SMT solvers but face limitations based on predicate types. This paper proposes a logic-based deobfuscation technique capable of handling Mixed Boolean Arithmetic obfuscation and dynamic opaque predicates using I/O analysis, program synthesis, and recursive matching. Experimental results show that the proposed method outperforms existing tools against obfuscation by Code Virtualizer, Tigress, and OLLVM.

Mixed Boolean-Arithmetic (MBA) obfuscation protects intellectual property by converting programs into forms that are more complex to analyze. However, MBA has been increasingly exploited by malware developers to evade detection and cause significant real-world problems. Traditional MBA deobfuscation methods often consider these expressions as part of a black box and overlook their internal semantic information. To bridge this gap, we propose a truth table, which is an automatically constructed semantic representation of an expression's behavior that does not rely on external resources. The truth table is a mathematical form that represents the output of expression for all possible combinations of input. We also propose a general and extensible guided MBA deobfuscation framework (gMBA) that modifies a Transformer-based neural encoder-decoder Seq2Seq architecture to incorporate this semantic guidance. Experimental results and in-depth analysis show that integrating expression semantics significantly improves performance and highlights the importance of internal semantic expressions in recovering obfuscated code to its original form.

Code obfuscation involves the addition of meaningless code or the complication of existing code in order to make a program difficult to reverse engineer. In recent years, MBA (Mixed Boolean Arithmetic) obfuscation has been applied to virus and malware code to impede expert analysis. Among the various obfuscation techniques, Mixed Boolean Arithmetic (MBA) obfuscation is considered the most challenging to decipher using existing code deobfuscation techniques. In this paper, we have attempted to simplify the MBA expression. We use an e-graph data structure to efficiently hold multiple expressions of the same semantics to systematically rewrite terms and find simpler expressions. The preliminary experimental result shows that our e-graph based MBA deobfuscation approach works faster with reasonable performance than other approaches do.

As program obfuscation techniques have improved, attackers have incorporated obfuscation into their malware and used it to thwart malware analysis. Opaque predicate is one of the widely used obfuscation methods to thwart code analysis, and we found that dynamic opaque predicate in particular cannot be deobfuscated with existing deobfuscators. This work proposes a dynamic opaque predicate detection technique based on recursive propagating of symbolic execution.

The development of web browsers has made it possible for people to share information with each other. However, as the use of browsers increases and their uses become more diverse, vulnerabilities are increasingly being discovered and exploited to cause various types of damage, such as stealing personal information from an unspecified number of people or maliciously placing malicious code in the browser to infect computers. In particular, most attacks are related to memory vulnerabilities, and web browsers also use the memory of JavaScript and WebAssembly through the V8 engine, and WebAssembly is a recently introduced low-level byte code language, so there are various problems. Typically, WebAssembly uses linear memory to improve browser speed. However, problems such as stack-based buffer overflows, heap metadata corruption, and data overwriting have arisen. As a recently emerged language, not much research has been done on it. Accordingly, this paper proposes memory protection through WeBMO, which uses the Bitwise Memory Operation (BMO) obfuscation technique to address WebAssembly's memory problem by manipulating and merging memory bit by bit using bitwise operations. Obfuscation is a technique that makes code written in a programming language difficult to read. By applying this obfuscation to WebAssembly memory, we propose a WeBMO design that mitigates vulnerabilities and protects memory from attackers.

Obfuscation is a powerful software protection technique. It changes a program into a more complicated one while preserving its semantics. Malware distributors also employ this method, to protect their malware from being understood by malware analysts. Thus, it is crucial to deobfuscate malware in a timely manner, to enable a prompt action to malware. This poster presents an efficient deobfuscation method using e-graph and equality saturation, a recent attention-gathering optimization technique, known for inherent theoretical efficiency in term-rewriting. Among the various deobfuscation techniques, we focus on Mixed Boolean Arithmetic (MBA) obfuscation, which is one of the most popular obfuscation methods due to its unparalleled strength and efficiency. We implement an e-graph and equality-saturation-based term-rewrite MBA deobfuscator, called EMBA, to simplify various sets of MBA-obfuscated expressions. By comparing its performance with state-of-the-art deobfuscators, we have shown that the equality saturation-based method has promising properties in MBA deobfuscation.

Program obfuscation protects a program's intellectual property rights and vulnerabilities by making it unreadable and hardening program analysis. However, obfuscation typically adds size and complexity to programs, resulting in performance overhead. Fortunately. opaque predicates, which are the conditional expressions always evaluated to be true or always false, reduce the overhead by ensuring that the inserted dummy code is never executed. Furthermore, when combined with other forms of obfuscation such as MBA obfuscation, opaque predicates have been found to efficiently defeat existing SMT-based analysis methods. However, new program analysis techniques have recently emerging that can simplify more obfuscation, which suggests that opaque predicate-based obfuscation may no longer be robust enough. in this paper, we introduce a novel opaque predicate classification, taking into account robustness against various dcobfuscation techniques. According to this proposed classification, we assess real-world obfuscation results produced by popular obfuscation tools.

Malware detection on binary executables provides a high availability to even binaries which are not disassembled or decompiled. However, a binary-level approach could cause ambiguity problems. In this paper, we propose a new feature engineering technique that use minimal knowledge about the internal layout on a binary. The proposed feature avoids the ambiguity problems by integrating the information about the layout with structural entropy. The experimental results show that our feature improves accuracy and F1-score by 3.3% and 0.07, respectively, on a CNN based malware detector with realistic benign and malicious samples.

The role of malware classification is crucial in addressing the explosive increase in malware variants. By classifying malware instances into malware families, malware analysts can apply appropriate techniques and tools to handle malware variants in each family. Using high-level representations of malware, such as disassembled codes, yields meaningful classification performance. However, malware classification based on disassembled codes depends on the practically implausible assumption that every malware is correctly reversed by disassemblers. Unfortunately, sophisticated malware, which has anti-disassembly capabilities, seeks to confuse disassemblers, yielding incorrectly disassembled codes. In this study, we focus on malware family classification, which requires no disassembly, and propose a new CNN-based malware classification model using non-disassembled malware files (i.e., binary files). Our model associates two modalities: “malware images” and “structural entropies,” which are converted and extracted from binary files. Both modalities have different granularities of bytes and chunks that complement each other. The model adopts a cross-modal attention mechanism to combine the features of the two modalities by moderating their expressive limitations. We validate our model using three popular datasets from the Kaggle Microsoft Malware Classification, Malimg, and BODMAS datasets. The experimental results show that our model identifies malware families with a higher degree of accuracy than previous methods and does not require the burden of disassembling.

Since buffer overflow has long been a frequently occurring, high-risk vulnerability, various methods have been developed to support spatial memory safety and prevent buffer overflow. However, every proposed method, although effective in part, has its limitations. Due to expensive bound-checking or large memory in taking for metadata, the software-only support for spatial memory safety inherently entails runtime overhead. Contrastingly, hardware-assisted methods are not available without specific hardware assistants. To mitigate such limitations, Herein we propose L4 Pointer, which is a 128-bit pointer extended from a normal 64-bit virtual addresses. By using the extra bits and widespread SIMD operations, L4 Pointer shows less slow-down and higher performance without hardware extension than existing methods.

Smart contracts running on blockchain potentially disclose all data to the participants of the chain. Therefore, because privacy is important in many areas, smart contracts may not be considered a good option. To overcome this limitation, this paper introduces Stone, a privacy preservation system for smart contracts. With Stone, an arbitrary Solidity smart contract can be combined with a separate privacy policy in JSON, which prevents the storage data in the contract from being publicised. Because this approach is convenient for policy developers as well as smart contract programmers, we envision that this approach will be practically acceptable for real-world applications.

Program obfuscation is one of the frequently used methods to make malware hard to analyze. Among the various obfuscation techniques, Mixed Boolean-Arithmetic (MBA) obfuscation, which mixes arithmetic and Boolean operations in an expression, is often considered hard to solve. Recently, synthesis-based methods have emerged to simplify MBA-obfuscated expressions. However, despite promising results, they still have limitations. Fortunately, recent work in super optimization shows that stochastic synthesis is generally sped up by a proper restart strategy. We adopt this principle to enhance the performance of existing works. Experimental results show that we would achieve improvement in the rate of correct answers and better length reduction.

Rapidly evolving malware has become a major cybersecurity threat. Several feature‐engineering techniques have been proposed to defend against malware attacks. An entropy is a typical indicator used in identifying malware. Structural entropy is a sequence of entropy values where an entropy of a segment is calculated by the equation of the entropy itself. However, entropy‐based features are likely to be abstract and miss important information. This article proposes a feature engineering technique that involves the concept of structural entropy. This technique allows every segment to be represented as 256 entropy values for every byte value, but not as an entropy value. Our research, fine‐granularity structural entropy (FiG_SE), incorporates global patterns across all segments, local patterns across adjacent segments, and internal patterns within the segments. To extract higher‐level characteristics from our entropy feature, we use a convolutional neural network (CNN) architecture because it is effective for extracting local and global patterns, and especially for shift‐invariant patterns. Our malware classification based on CNN with the proposed feature outperforms the previous classification methods that use byte streams, entropy streams, and structural‐entropy‐based streams as inputs. Moreover, our research combined with CNN is highly resilient to obfuscation techniques and is also well suited to malware detection.

MBA (mixed boolean and arithmetic) expressions are hard to simplify, so used for malware obfuscation to hinder analysts' diagnosis. Some MBA simplification methods with high performance have been developed, but they narrowed the target to "linear" MBA expressions, which allows efficient solutions based on logic/term-rewriting. However such restrictions are not appropriate for general forms of MBA expressions usually appearing in malware. To overcome this limitation, we introduce a "semi-linear" MBA expression, a new class of MBA expression extended from a linear MBA expression, and propose a new MBA simplifier called "SSLEM", based on a simplification idea of semi-linear MBA expressions and program synthesis

프로그램 난독화는 코드를 변환시켜서, 동일한 의미를 가지면서 읽기 어렵게 만든다. 공격자들은 악성코드가 분석되지 않게 만들기 위해 난독화를 사용한다. 난독화 기술 중 산술 연산과 부울 연산을 혼합하여 복잡하게 변환하는 MBA 난독화를 해제하기 위하여 프로그램 합성을 도입하는 연구가 최근 발표되고 있다. 본 연구에서는 기존의 여러 MBA 난독화 해제 도구의 장점을 전략적으로 활용하는 합성기반 MBA 난독화 해제 도구 PLASynth를 소개한다. PLASynth는 여러 합성기반 MBA 간소화 도구를 실험을 통해 분석하고 이를 효과적으로 결합하여 더욱 성능이 우수한 난독화 해제 결과를 내는 것을 목표로 한다. 이를 위해 단순하게 결합하는 대신 기존 도구의 특성을 분석하였고 재탐색 기법 등을 통해서 조작하는 개선된 알고리즘을 적용한다. MBA 표현식 데이터 셋에 여러 단순화 도구를 적용하고 비교한 결과, PLASynth가 정답률이 높으며 길이 감소율이 우수함을 확인하였다.

File entropy is one of the major indicators of crypto-ransomware because the encryption by ransomware increases the randomness of file contents. However, entropy-based ransomware detection has certain limitations; for example, when distinguishing ransomware-encrypted files from normal files with inherently high-level entropy, misclassification is very possible. In addition, the entropy evaluation cost for an entire file renders entropy-based detection impractical for large files. In this paper, we propose two indicators based on byte frequency for use in ransomware detection; these are termed EntropySA and DistSA, and both consider the interesting characteristics of certain file subareas termed “sample areas” (SAs). For an encrypted file, both the sampled area and the whole file exhibit high-level randomness, but for a plain file, the sampled area embeds informative structures such as a file header and thus exhibits relatively low-level randomness even though the entire file exhibits high-level randomness. EntropySA and DistSA use “byte frequency” and a variation of byte frequency, respectively, derived from sampled areas. Both indicators cause less overhead than other entropy-based detection methods, as experimentally proven using realistic ransomware samples. To evaluate the effectiveness and feasibility of our indicators, we also employ three expensive but elaborate classification models (neural network, support vector machine and threshold-based approaches). Using these models, our experimental indicators yielded an average F 1-measure of 0.994 and an average detection rate of 99.46% for file encryption attacks by realistic ransomware samples.