Indirect function call target identification in software

Patent metadata

Field	Value
Publication number	US-11853751-B2
Application number	US-202117644021-A
Country	US
Kind code	B2
Filing date	Dec 13, 2021
Priority date	Dec 13, 2021
Publication date	Dec 26, 2023
Grant date	Dec 26, 2023

Abstract

Indirect function call target identification in software is provided. A set of explicit data flows that pass a function address between software modules of a program is determined using an explicit data dependency analysis. A set of indirect function call targets is generated from results of the explicit data dependency analysis and a dynamic execution analysis of the program. The set of indirect function call targets is expanded by identifying similar target functions based on feature embeddings generated by a graph neural network.

First claim

What is claimed is:

1. A method for indirect function call target identification in software, the method comprising:
determining a set of explicit data flows that pass a function address between software modules of a program using an explicit data dependency analysis;
generating a set of indirect function call targets from results of the explicit data dependency analysis and a dynamic execution analysis of the program; and
expanding the set of indirect function call targets by identifying similar target functions based on feature embeddings generated by a graph neural network.

2. The method of claim 1 further comprising:
generating a function call graph corresponding to the program that includes features of functions of the program based on static analysis of source code of the program, wherein the function call graph is a graph structure that depicts the functions of the program as nodes and function calls corresponding to the functions as edges between the nodes of the graph structure; and
training the graph neural network to identify the features of the functions of the program using the function call graph of the program.

3. The method of claim 2 further comprising:
generating the feature embeddings corresponding to the features of the functions of the program using the trained graph neural network; and
placing similar functions of the program with similar features in a same cluster based on the feature embeddings corresponding to the features of the functions of the program.

4. The method of claim 3 further comprising:
using a clustering algorithm to cluster functions of the program that have similar features together based on the generated feature embeddings that correspond to the features of the functions of the program.

5. The method of claim 3 , wherein a set of feature embeddings is generated for each respective function of the program.

6. The method of claim 1 further comprising:
performing the explicit data dependency analysis on source code of the program to identify data dependencies between modules of the program corresponding to indirect function call targets;
performing the dynamic execution analysis on binary of the program to identify indirect function call targets; and
generating a set of ground-truth indirect function call targets based on the explicit data dependency analysis of the source code and the dynamic execution analysis of the binary of the program.

7. The method of claim 6 further comprising:
performing a search of clusters of similar functions to identify one or more clusters of similar functions having similar features with the set of ground-truth indirect function call targets; and
expanding the set of ground-truth indirect function call targets to include the one or more clusters of similar functions based on the search to form an expanded set of indirect function call targets.

8. The method of claim 7 further comprising:
performing at least one of fuzz testing, vulnerability detection, or exploitation discovery of the program using the expanded set of indirect function call targets.

9. The method of claim 1 , wherein one of a compiler or a program analysis tool is used for the explicit data dependency analysis; and the graph neural network that is trained based on a function call graph of the program and function features is used to search for similar functions.

10. A computer system for indirect function call target identification in software, the computer system comprising:
a bus system;
a storage device connected to the bus system, wherein the storage device stores program instructions; and
a processor connected to the bus system, wherein the processor executes the program instructions to:
determine a set of explicit data flows that pass a function address between software modules of a program using an explicit data dependency analysis;
generate a set of indirect function call targets from results of the explicit data dependency analysis and a dynamic execution analysis of the program; and
expand the set of indirect function call targets by identifying similar target functions based on feature embeddings generated by a graph neural network.

11. The computer system of claim 10 , wherein the processor further executes the program instructions to:
generate a function call graph corresponding to the program that includes features of functions of the program based on static analysis of source code of the program, wherein the function call graph is a graph structure that depicts the functions of the program as nodes and function calls corresponding to the functions as edges between the nodes of the graph structure; and
train the graph neural network to identify the features of the functions of the program using the function call graph of the program.

12. The computer system of claim 11 , wherein the processor further executes the program instructions to:
generate the feature embeddings corresponding to the features of the functions of the program using the trained graph neural network; and
place similar functions of the program with similar features in a same cluster based on the feature embeddings corresponding to the features of the functions of the program.

13. The computer system of claim 10 , wherein the processor further executes the program instructions to:
perform the explicit data dependency analysis on source code of the program to identify data dependencies between modules of the program corresponding to indirect function call targets;
perform the dynamic execution analysis on binary of the program to identify indirect function call targets; and
generate a set of ground-truth indirect function call targets based on the explicit data dependency analysis of the source code and the dynamic execution analysis of the binary of the program.

14. The computer system of claim 13 , wherein the processor further executes the program instructions to:
perform a search of clusters of similar functions to identify one or more clusters of similar functions having similar features with the set of ground-truth indirect function call targets; and
expand the set of ground-truth indirect function call targets to include the one or more clusters of similar functions based on the search to form an expanded set of indirect function call targets.

15. A computer program product for indirect function call target identification in software, the computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method of:
determining a set of explicit data flows that pass a function address between software modules of a program using an explicit data dependency analysis;
generating a set of indirect function call targets from results of the explicit data dependency analysis and a dynamic execution analysis of the program; and
expanding the set of indirect function call targets by identifying similar target functions based on feature embeddings generated by a graph neural network.

16. The computer program product of claim 15 further comprising:
generating a function call graph corresponding to the program that includes features of functions of the program based on static analysis of source code of the program, wherein the function call graph is a graph structure that depicts the functions of the program as nodes and function calls corresponding to the functions as edges between the nodes of the graph structure; and
training the graph neural network to identify the features of the functions of

Assignees

• IBM

Inventors

• Wu Qiushi
• Gu Zhongshu
• Jamjoom Hani Talal

Classifications

• G06N3/08

  Learning methods · CPC title

• G06N3/045

  Combinations of networks · CPC title

• G06F8/433

  Dependency analysis; Data or control flow analysis · CPC title

• G06F8/75 Primary

  Structural analysis for program understanding · CPC title