信息网络安全

信息网络安全 ›› 2025, Vol. 25 ›› Issue (9): 1357-1366.doi: 10.3969/j.issn.1671-1122.2025.09.004

• 入选论文 • 上一篇    下一篇

基于增强型语义程序依赖图的智能化二进制分析方法

薛磊1(), 张际灿1, 杜平心2   

  1. 1.中山大学网络空间安全学院，深圳 518107
    2.绿盟科技集团股份有限公司，北京 100089
  • 收稿日期:2025-05-19 出版日期:2025-09-10 发布日期:2025-09-18
  • 通讯作者: 薛磊 xuelei3@mail.sysu.edu.cn
  • 作者简介:薛磊（1987—），男，山东，副教授，博士，CCF高级会员，主要研究方向为智能网联系统安全、二进制程序分析|张际灿（1998—），男，山东，博士研究生，主要研究方向为软件安全、程序分析|杜平心（1990—），男，北京，研究员，硕士，主要研究方向为软件安全
  • 基金资助:
    国家自然科学基金(62372490)

Intelligent Binary Analysis Method Based on Enhanced Semantic Program Dependency Graph

XUE Lei1(), ZHANG Jican1, DU Pingxin2   

  1. 1. School of Cyber Science and Technology, Sun Yat-sen University, Shenzhen 518107, China
    2. NSFOCUS Technologies Group Co., Ltd., Beijing 100089, China
  • Received:2025-05-19 Online:2025-09-10 Published:2025-09-18

RichHTML

25

PDF (PC)

46

摘要：

在软件安全分析领域，二进制程序分析技术正面临编译器优化复杂化与结构信息缺失带来的双重挑战，传统工具链普遍存在分析流程割裂、依赖人工操作、语义表达不足等问题，难以满足结构化、自动化漏洞挖掘任务的需求。文章提出一种基于增强型语义程序依赖图的智能化二进制分析方法，通过统一建模控制流、数据依赖与符号路径约束信息，实现对程序语义的三维结构化表达。在实验评估中，增强型语义程序依赖图展现了显著的性能优势，在 OpenSSL 项目无优化级别下，SPDG 恢复的基本块数比 Ghidra 提升了60.5%，控制边数提升了42.5%；SPDG在数据依赖追踪上也比 Ghidra 提升了287.1%，恢复了超过13万条数据依赖链。此外，在符号执行覆盖率方面，SPDG 在 OpenSSL 的无优化级别下达到 64.7%，优于Angr的60%。在漏洞检测任务中，SPDG 成功识别了 9 个漏洞样例，仅误报 1 次，准确率达 90.0%，显著高于其他工具。

关键词: 二进制分析, 控制流, 数据流, 符号执行, 程序依赖图

Abstract:

In the field of software security analysis, binary program analysis technology faces the dual challenges of complex compiler optimization and a lack of structural information. Traditional toolchains commonly suffer from fragmented analysis processes, reliance on manual operations, and insufficient semantic expression, making them unable to meet the demands of structured, automated vulnerability discovery. This paper proposed an intelligent binary analysis method based on an enhanced Semantic Program Dependence Graph (SPDG). By uniformly modeling control flow (CFG), data dependency (DDG), and symbolic path constraint information, SPDG achieves a three-dimensional structured representation of program semantics. In experimental evaluations, SPDG demonstrates significant performance advantages. At the unoptimized level of the OpenSSL project, SPDG recoveres 60.5% more basic blocks and 42.5% more control edges than Ghidra. SPDG also improves data dependency tracing by 287.1% over Ghidra, recovering over 130,000 data dependency chains. Furthermore, SPDG achieves 64.7% symbolic execution coverage at the unoptimized level of OpenSSL, surpassing Angr’s 60%. In the vulnerability detection task, SPDG successfully identifies nine vulnerability examples with only one false positive, achieving an accuracy rate of 90.0%, which is significantly higher than other tools.

Key words: binary analysis, control flow, data flow, symbolic execution, program dependency graph

中图分类号: