title: ÐÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ðµ Ð¿ÑÐ¾Ð¼ÐµÐ¶ÑÑÐ¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ ÐºÐ¾Ð´Ð° Ð¿ÑÐ¸ Ð¿Ð¾Ð¸ÑÐºÐµ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð°Ñ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð³ÑÐ°ÑÐ¾Ð²Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Application of an intermediate code representation when searching for vulnerabilities in executable files based on graph analysis
Creators: name: Ð¡Ð¾Ð»Ð¾Ð²ÑÐµÐ², ÐÐ¸ÑÐ¸Ð»Ð»
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2023
Subjects: Ð¡ÑÐ°ÑÐ¸ÑÑÐ¸ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð·
ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ñ
Ð¿Ð¾Ð¸ÑÐº ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹
Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÐ¹ ÑÐ°Ð¹Ð»
Ð¿ÑÐ¾Ð¼ÐµÐ¶ÑÑÐ¾ÑÐ½Ð¾Ðµ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¸Ðµ
vulnerability scanning
executable file
intermediate representation

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼Ð¾Ð¼ ÐºÐ¾Ð´Ðµ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ Ð¿ÑÐ¾Ð¼ÐµÐ¶ÑÑÐ¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ ÐºÐ¾Ð´Ð° Ð¸ Ð³ÑÐ°ÑÐ¾Ð²Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. ÐÐ±ÑÐµÐºÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ Ð¾Ð±ÑÐ°Ð·ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ Ð¼ÐµÑÐ¾Ð´Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Ð¸ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ñ, ÐºÐ¾ÑÐ¾ÑÑÐµ Ð¼Ð¾Ð³ÑÑ Ð¿ÑÐ¸Ð¼ÐµÐ½ÑÑÑÑÑ Ð´Ð»Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¿Ð¾ÑÐµÐ½ÑÐ¸Ð°Ð»ÑÐ½Ð¾ ÑÑÐ·Ð²Ð¸Ð¼ÑÑ ÑÑÐ½ÐºÑÐ¸Ð¹. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÐ½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐµÐ¹ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹. 2. ÐÐ½Ð°Ð»Ð¸Ð· ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÑ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð¾Ð² Ðº Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð°Ñ, Ð² ÑÐ¾Ð¼ ÑÐ¸ÑÐ»Ðµ Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. 3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼ÐµÑÐ¾Ð´Ð° Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð³ÑÐ°ÑÐ¾Ð²Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð¿ÑÐ¾Ð¼ÐµÐ¶ÑÑÐ¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼Ð¾Ð³Ð¾ ÐºÐ¾Ð´Ð°. 4. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð°, Ð¿Ð¾Ð·Ð²Ð¾Ð»ÑÑÑÐµÐ³Ð¾ Ð¾Ð¿ÑÐµÐ´ÐµÐ»Ð¸ÑÑ Ð² Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼Ð¾Ð¼ ÑÐ°Ð¹Ð»Ðµ Ð¿Ð¾ÑÐµÐ½ÑÐ¸Ð°Ð»ÑÐ½Ð¾ ÑÑÐ·Ð²Ð¸Ð¼ÑÐµ ÑÑÐ½ÐºÑÐ¸Ð¸ Ð¸ Ð¿ÑÑÐ¸ Ð¸Ñ Ð´Ð¾ÑÑÐ¸Ð¶ÐµÐ½Ð¸Ñ. 5. ÐÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿Ð°. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¾ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð¾ Ð´Ð»Ñ Ð¿Ð¾Ð¸ÑÐºÐ° Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð°Ñ, Ð¿ÑÐ¸Ð¼ÐµÐ½ÑÑÑÐµÐµ Ð¼ÐµÑÐ¾Ð´Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸ Ð±ÑÐ»Ð° Ð¿ÑÐ¾Ð´ÐµÐ¼Ð¾Ð½ÑÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð° ÐµÐ³Ð¾ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ Ð¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð².
description: The purpose of the work is to search for vulnerabilities in the executable code based on static analysis with use of intermediate representation of the code and graph analysis. The object of research is the samples of vulnerable software. The subject of the research is the methods of static analysis for automatic search for software weaknesses in executable files. The research set the following goals: 1. Analysis of the existing vulnerability classification. 2. Analysis of modern approaches to identifying vulnerabilities in executable files, including the use of static analysis. 3. Development of a method for vulnerability detection based on graph analysis with the use of intermediate representation of code. 4. Development of software tool, which is able to identify the potentially vulnerable functions in an executable files and ways of reaching them. 5. Performing tests of the developed prototype. The work resulted in development of the tool for searching potential vulnerabilities in executable files by applying static analysis methods and its effectiveness was demonstrated. The results could be used as a basis for designing static analysis systems for executable files.