Sciweavers

Share
PASTE
2010
ACM

Extracting compiler provenance from program binaries

10 years 2 months ago
Extracting compiler provenance from program binaries
We present a novel technique that identifies the source compiler of program binaries, an important element of program provenance. Program provenance answers fundamental questions of malware analysis and software forensics, such as whether programs are generated by similar tool chains; it also can allow development of debugging, performance analysis, and instrumentation tools specific to particular compilers. We formulate compiler identification as a structured learning problem, automatically building models to recognize sequences of binary code generated by particular compilers. We evaluate our techniques on a large set of real-world test binaries, showing that our models identify the source compiler of binary code with over 90% accuracy, even in the presence of interleaved code from multiple compilers. A case study demonstrates the use of inferred compiler provenance to augment stripped binary parsing, reducing parsing errors by 18%. Categories and Subject Descriptors D.3.4 [Progr...
Nathan E. Rosenblum, Barton P. Miller, Xiaojin Zhu
Added 10 Jul 2010
Updated 10 Jul 2010
Type Conference
Year 2010
Where PASTE
Authors Nathan E. Rosenblum, Barton P. Miller, Xiaojin Zhu
Comments (0)
books