P1OVD: Patch-Based 1-Day Out-of-Bounds Vulnerabilities Detection Tool for Downstream Binaries
In the past decades, due to the popularity of cloning open-source software, 1-day vulnerabilities are prevalent among cyber-physical devices. Detection tools for 1-day vulnerabilities effectively protect users who fail to adopt 1-day vulnerability patches in time. However, manufacturers can non-stan...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-01-01
|
| Series: | Electronics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2079-9292/11/2/260 |
| _version_ | 1797494474466656256 |
|---|---|
| author | Hongyi Li Daojing He Xiaogang Zhu Sammy Chan |
| author_facet | Hongyi Li Daojing He Xiaogang Zhu Sammy Chan |
| author_sort | Hongyi Li |
| collection | DOAJ |
| description | In the past decades, due to the popularity of cloning open-source software, 1-day vulnerabilities are prevalent among cyber-physical devices. Detection tools for 1-day vulnerabilities effectively protect users who fail to adopt 1-day vulnerability patches in time. However, manufacturers can non-standardly build the binaries from customized source codes to multiple architectures. The code variants in the downstream binaries decrease the accuracy of 1-day vulnerability detections, especially when signatures of out-of-bounds vulnerabilities contain incomplete information of vulnerabilities and patches. Motivated by the above observations, in this paper, we propose P1OVD, an effective patch-based 1-day out-of-bounds vulnerability detection tool for downstream binaries. P1OVD first generates signatures containing patch information and vulnerability root cause information. Then, P1OVD uses an accurate and robust matching algorithm to scan target binaries. We have evaluated P1OVD on 104 different versions of 30 out-of-bounds vulnerable functions and 620 target binaries in six different compilation environments. The results show that P1OVD achieved an accuracy of 83.06%. Compared to the widely used patch-level vulnerability detection tool ReDeBug, P1OVD ignores 4.07 unnecessary lines on average. The experiments on the <i>x86_64</i> platform and the <i>O0</i> optimization show that P1OVD increases the accuracy of the state-of-the-art tool, BinXray, by 8.74%. Besides, it can analyze a single binary in 4 s after a 20-s offline signature extraction on average. |
| first_indexed | 2024-03-10T01:34:49Z |
| format | Article |
| id | doaj.art-b6fd7461182c4bcd9e539369340e9da4 |
| institution | Directory Open Access Journal |
| issn | 2079-9292 |
| language | English |
| last_indexed | 2024-03-10T01:34:49Z |
| publishDate | 2022-01-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Electronics |
| spelling | doaj.art-b6fd7461182c4bcd9e539369340e9da42023-11-23T13:34:53ZengMDPI AGElectronics2079-92922022-01-0111226010.3390/electronics11020260P1OVD: Patch-Based 1-Day Out-of-Bounds Vulnerabilities Detection Tool for Downstream BinariesHongyi Li0Daojing He1Xiaogang Zhu2Sammy Chan3Software Engineering Institute, East China Normal University, Shanghai 200062, ChinaSoftware Engineering Institute, East China Normal University, Shanghai 200062, ChinaDepartment of Computer Science and Software Engineering, School of Software and Electrical Engineering, Swinburne University of Technology, Melbourne 3122, AustraliaDepartment of Electrical Engineering, City University of Hong Kong, Hong Kong SAR, ChinaIn the past decades, due to the popularity of cloning open-source software, 1-day vulnerabilities are prevalent among cyber-physical devices. Detection tools for 1-day vulnerabilities effectively protect users who fail to adopt 1-day vulnerability patches in time. However, manufacturers can non-standardly build the binaries from customized source codes to multiple architectures. The code variants in the downstream binaries decrease the accuracy of 1-day vulnerability detections, especially when signatures of out-of-bounds vulnerabilities contain incomplete information of vulnerabilities and patches. Motivated by the above observations, in this paper, we propose P1OVD, an effective patch-based 1-day out-of-bounds vulnerability detection tool for downstream binaries. P1OVD first generates signatures containing patch information and vulnerability root cause information. Then, P1OVD uses an accurate and robust matching algorithm to scan target binaries. We have evaluated P1OVD on 104 different versions of 30 out-of-bounds vulnerable functions and 620 target binaries in six different compilation environments. The results show that P1OVD achieved an accuracy of 83.06%. Compared to the widely used patch-level vulnerability detection tool ReDeBug, P1OVD ignores 4.07 unnecessary lines on average. The experiments on the <i>x86_64</i> platform and the <i>O0</i> optimization show that P1OVD increases the accuracy of the state-of-the-art tool, BinXray, by 8.74%. Besides, it can analyze a single binary in 4 s after a 20-s offline signature extraction on average.https://www.mdpi.com/2079-9292/11/2/260out-of-boundsvulnerable detectionpatch |
| spellingShingle | Hongyi Li Daojing He Xiaogang Zhu Sammy Chan P1OVD: Patch-Based 1-Day Out-of-Bounds Vulnerabilities Detection Tool for Downstream Binaries Electronics out-of-bounds vulnerable detection patch |
| title | P1OVD: Patch-Based 1-Day Out-of-Bounds Vulnerabilities Detection Tool for Downstream Binaries |
| title_full | P1OVD: Patch-Based 1-Day Out-of-Bounds Vulnerabilities Detection Tool for Downstream Binaries |
| title_fullStr | P1OVD: Patch-Based 1-Day Out-of-Bounds Vulnerabilities Detection Tool for Downstream Binaries |
| title_full_unstemmed | P1OVD: Patch-Based 1-Day Out-of-Bounds Vulnerabilities Detection Tool for Downstream Binaries |
| title_short | P1OVD: Patch-Based 1-Day Out-of-Bounds Vulnerabilities Detection Tool for Downstream Binaries |
| title_sort | p1ovd patch based 1 day out of bounds vulnerabilities detection tool for downstream binaries |
| topic | out-of-bounds vulnerable detection patch |
| url | https://www.mdpi.com/2079-9292/11/2/260 |
| work_keys_str_mv | AT hongyili p1ovdpatchbased1dayoutofboundsvulnerabilitiesdetectiontoolfordownstreambinaries AT daojinghe p1ovdpatchbased1dayoutofboundsvulnerabilitiesdetectiontoolfordownstreambinaries AT xiaogangzhu p1ovdpatchbased1dayoutofboundsvulnerabilitiesdetectiontoolfordownstreambinaries AT sammychan p1ovdpatchbased1dayoutofboundsvulnerabilitiesdetectiontoolfordownstreambinaries |