Creating an Interprocedural Analyst-Oriented Data Flow Representation for Binary Analysts (CIAO)
- Sandia National Lab. (SNL-NM), Albuquerque, NM (United States). Threat Intelligence Center
- Sandia National Lab. (SNL-NM), Albuquerque, NM (United States). Quality Assurance Center
- Sandia National Laboratories (SNL), Albuquerque, NM, and Livermore, CA (United States)
- Sandia National Lab. (SNL-NM), Albuquerque, NM (United States)
- Georgia Inst. of Technology, Atlanta, GA (United States)
National security missions require understanding third-party software binaries, a key element of which is reasoning about how data flows through a program. However, vulnerability analysts protecting software lack adequate tools for understanding data flow in binaries. To reduce the human time burden for these analysts, we used human factors methods in a rolling discovery process to derive user-centric visual representation requirements. We encountered three main challenges: analysis projects span weeks, analysis goals significantly affect approaches and required knowledge, and analyst tools, techniques, conventions, and prioritization are based on personal preference. To address these challenges, we initially focused our human factors methods on an attack surface characterization task. We generalized our results using a two-stage modified sorting task, creating requirements for a data flow visualization. We implemented these requirements partially in manual static visualizations, which we informally evaluated, and partially in automatically generated interactive visualizations, which have yet to be integrated into workflows for evaluation. Our observations and results indicate that 1) this data flow visualization has the potential to enable novel code navigation, information presentation, and information sharing, and 2) it is an excellent time to pursue research applying human factors methods to binary analysis workflows.
- Research Organization:
- Sandia National Laboratories (SNL-NM), Albuquerque, NM (United States)
- Sponsoring Organization:
- USDOE National Nuclear Security Administration (NNSA)
- DOE Contract Number:
- AC04-94AL85000; NA0003525
- OSTI ID:
- 1529591
- Report Number(s):
- SAND--2018-14238; 670958
- Country of Publication:
- United States
- Language:
- English
Similar Records
Analyst Tools and Quality Control Software for the ARM Data System
Moving from Descriptive to Causal Analytics: Case Study of the Health Indicators Warehouse