Automated mapping of large binary objects using primitive fragment type classification

详细信息    查看全文

• 作者：Gregory Conti ; Sergey Bratus ; Anna Shubina ; Benjamin Sangster ; Roy Ragsdale ; Matthew Supan ; Andrew Lichtenberg ; Robert Perez-Alemany
• 关键词：Binary mapping ; Binary analysis ; File carving ; Hex editors ; Classification ; Reverse engineering
• 刊名：Digital Investigation
• 出版年：2010
• 出版时间：August 2010
• 年：2010
• 卷：7
• 期：Supplement 1
• 页码：S3-S12
• 全文大小：1012 K

文摘

Security analysts, reverse engineers, and forensic analysts are regularly faced with large binary objects, such as executable and data files, process memory dumps, disk images and hibernation files, often Gigabytes or larger in size and frequently of unknown, suspect, or poorly documented structure. Binary objects of this magnitude far exceed the capabilities of traditional hex editors and textual command line tools, frustrating analysis. This paper studies automated means to map these large binary objects by classifying regions using a multi-dimensional, information-theoretic approach. We make several contributions including the introduction of the binary mapping metaphor and its associated applications, as well as techniques for type classification of low-level binary fragments. We validate the efficacy of our approach through a series of classification experiments and an analytic case study. Our results indicate that automated mapping can help speed manual and automated analysis activities and can be generalized to incorporate many low-level fragment classification techniques.