US 12,694,122 B2Granted

Systems and methods for reverse engineering-based detection of vulnerabilities

AssigneeBigBear.ai LLC

InventorEric Conway

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present disclosure provides systems and methods that support identification of vulnerabilities within a dataset, such as an unknown binary, using customizable pipelines and workflows. The pipelines may be configured to apply various analysis techniques, including reverse engineering, machine learning/artificial intelligence, and other techniques to elicit various types of data and information from the unknown binary. The pipeline may include stages configured to analyze outputs of prior stages of the pipeline detect whether vulnerabilities or malicious code are present. Different stages of the pipeline may also be configured to initiate additional workflows for further analysis of the binary or intermediate representations of the binary output by prior stages of the pipeline. Additionally, the disclosed systems and methods provide functionality that enables generation of a reverse software bill of materials (SBOM) from an unknown binary or confirmation of contents of an existing SBOM.

Claims20

Dependent claims

A method comprising:

receiving, by one or more processors, an input dataset comprising at least an unknown binary, wherein the unknown binary is associated with unknown or incomplete source code, documentation, software bill of material (SBOM), or any combination thereof;
identifying, by the one or more processors, at least one feature associated with the unknown binary, wherein the at least one feature comprises at least a type of data of the input dataset;
initializing, based on at least the type of data and by the one or more processors, one or more pipelines configured to detect vulnerabilities within the unknown binary based on the at least one feature, wherein each pipeline of the one or more pipelines comprises at least one data collector executable by the one or more processors and at least one information extractor executable by the one or more processors;
generating, via one or more data collectors of a first pipeline of the one or more pipelines, data based on the unknown binary, wherein the data comprises a first intermediate representation of at least a portion of the unknown binary;
determining, via the at least one information extractor of the first pipeline, whether a vulnerability is present in the unknown binary based on a similarity between one or more characteristics of information extracted from the data generated by the one or more data collectors of the first pipeline and information associated with at least one known vulnerability;
and
generating a reverse software bill of materials for the unknown binary based on the data generated by the one or more data collectors, the information extracted from the data generated by the one or more data collectors by the at least one information extractor, or a combination thereof, wherein the reverse software bill of materials comprises information associated with vulnerabilities determined to be present in the unknown binary, software components associated with the unknown binary, dependencies between the software components, license information associated with the software components, risk assessment information associated with the unknown binary, or a combination thereof.

4 more elements

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

receiving an input dataset comprising at least an unknown binary, wherein the unknown binary is associated with unknown or incomplete source code, documentation, software bill of material (SBOM), or any combination thereof;
initializing, based on at least a type of data of the input dataset, one or more pipelines configured to analyze the unknown binary, wherein each pipeline of the one or more pipelines comprises at least one data collector executable by the one or more processors and at least one information extractor executable by the one or more processors;
generating, via one or more data collectors of a first pipeline of the one or more pipelines, data based on the unknown binary, wherein the data comprises a first intermediate representation of at least a portion of the unknown binary, wherein each of the one or more data collectors are configured to process a respective type of data;
determining, via the at least one information extractor of the first pipeline, whether a vulnerability is present in the unknown binary based on a similarity between one or more characteristics of information extracted from the data generated by the one or more data collectors of the first pipeline and information associated with at least one known vulnerability;
and
generating a reverse software bill of materials for the unknown binary based on the data generated by the one or more data collectors, the information extracted from the data generated by the one or more data collectors by the at least one information extractor, or a combination thereof, wherein the reverse software bill of materials comprises information associated with vulnerabilities determined to be present in the unknown binary, software components associated with the unknown binary, dependencies between the software components, license information associated with the software components, risk assessment information associated with the unknown binary, or a combination thereof.

3 more elements

A system comprising:

a memory comprising a primary datastore and a secondary datastore;
one or more processors communicatively coupled to the memory, the one or more processors configured to:
initialize, based on at least a type of data, one or more pipelines configured to analyze an unknown binary, wherein the unknown binary is associated with unknown or incomplete source code, documentation, software bill of material (SBOM), or any combination thereof, wherein each pipeline of the one or more pipelines comprises at least one data collector executable by the one or more processors and at least one information extractor executable by the one or more processors, wherein each of the at least one data collector is configured to process a respective type of data;
generate, via one or more data collectors of a first pipeline of the one or more pipelines, data based on the unknown binary, wherein the data comprises a first intermediate representation of at least a portion of the unknown binary;
store the data at the primary datastore;
determine, via the at least one information extractor of the first pipeline, whether a vulnerability is present in the unknown binary based on a similarity between one or more characteristics of information extracted from the data generated by the one or more data collectors of the first pipeline and information associated with at least one known vulnerability;
store the information extracted from the data generated by the one or more data collectors in the primary datastore and the portion of the information extracted from the data generated by the one or more data collectors in the secondary datastore;
output, to a graphical user interface, information associated with a vulnerability determined to be present in the unknown binary, at least a portion of the information extracted from the data generated by the one or more data collectors, or both, wherein the portion of the information extracted from the data generated by the one or more data collectors is stored in the secondary datastore and output to the graphical user interface via an application programming interface configured to enable interaction with the portion of the information extracted from the data generated by the one or more data collectors from the secondary datastore via interactive elements of the graphical user interface;
and
generate a reverse software bill of materials for the unknown binary based on the data generated by the one or more data collectors, the information extracted from the data generated by the one or more data collectors by the at least one information extractor, or a combination thereof, wherein the reverse software bill of materials comprises information associated with vulnerabilities determined to be present in the unknown binary, software components associated with the unknown binary, dependencies between the software components, license information associated with the software components, risk assessment information associated with the unknown binary, or a combination thereof.

7 more elements

Dependencies are inferred from the claim text.