Detecting Standard Library Functions in Obfuscated Code

Binary analysis helps find low-level system bugs in embedded systems, middleware, and Internet of Things (IoT) devices. However, obfuscation makes static analysis more challenging. In this work we use machine learning to detect standard library functions in compiled code which has been heavily obfuscated. First we create a C library function dataset augmented by obfuscation and diverse compiler options. We then train an ensemble of Paragraph Vector-Distributed Memory (PV-DM) models on this dataset, and combine their predictions with simple majority voting. Although the average accuracy of individual PV-DM classifiers is 68%, the ensemble is 74% accurate. Finally, we train a separate model on the graph structure of the disassembled data. This graph classifier is 64% accurate on its own, but does not improve accuracy when added to the ensemble. Unlike previous work, our approach works even with heavy obfuscation, an advantage we attribute to increased diversity of our training data and increased capacity of our ensemble model.