Presentation is loading. Please wait.

Presentation is loading. Please wait.

Automated Mapping of Large Binary Objects Ben Sangster Roy Ragsdale Greg Conti

Similar presentations


Presentation on theme: "Automated Mapping of Large Binary Objects Ben Sangster Roy Ragsdale Greg Conti"— Presentation transcript:

1 Automated Mapping of Large Binary Objects Ben Sangster Roy Ragsdale Greg Conti http://www.loc.gov/loc/lcib/0611/images/map.jpg

2 The views expressed in this presentation are those of the author and do not reflect the official policy or position of the United States Military Academy, the Department of the Army, the Department of Defense or the U.S. Government. http://www.cdcr.ca.gov/News/Images/overcrowding/MuleCreek_071906v1.jpg

3 Motivation 0400-07FF1024-2047Screen memory 0800-9FFF2048-40959Basic ROM memory 8000-9FFF32758-40959Alternate: Rom plug-in area A000-BFFF40960-49151ROM : Basic A000-BFFF49060-59151Alternate: RAM C000-CFFF49152-53247RAM memory, including alternate D000-D02E53248-53294Video Chip (6566) D400-D41C54272-54300Sound Chip (6581 SID) D800-DBFF55296-56319Color nybble memory DC00-DC0F56320-56335Interface chip 1, IRQ (6526 CIA) DD00-DD0F56576-56591Interface chip 2, NMI (6526 CIA) D000-DFFF53248-53294Alternate: Character set E000-FFFF57344-65535ROM: Operating System E000-FFFF57344-65535Alternate : RAM FF81-FFF565409-65525Jump Table

4 Goals Accurately identify regions within arbitrary binary object Efficient algorithms Extensible framework Automated mapping process Automated process for generating test data Current State: BINMAP Utility

5

6 insert ~ 5MB here... 0 ~12MB

7 insert ~ 5MB here... 0 ~12MB ASCII Text Compressed Image 1 Compressed Image N Unicode URLs Data Structure

8 0N0N f(x)

9 0N0N

10 binary fragment high entropymedium entropy low entropy encryptioncompressionrepeating values machine code human language data structures uncompressed media RLE LZW...EN FR RU...AES DES... ECB CBC... Partial Taxonomy

11 Goal 0400-07FF1024-2047ASCII Text (English) 0800-9FFF2048-40959Pointer Table 8000-9FFF32758-40959Variable Length Array A000-BFFF40960-49151Compressed Data A000-BFFF49060-59151Unicode (Basic Latin) C000-CFFF49152-53247Unknown Region D000-D02E53248-53294Repeating Value (0xFF) D400-D41C54272-54300Encrypted Region (AES) D800-DBFF55296-56319PNG Image DC00-DC0F56320-56335JavaScript DD00-DD0F56576-56591Encrypted Region (RSA Key?) D000-DFFF53248-53294Unknown Region E000-FFFF57344-65535BMP Image E000-FFFF57344-65535Unicode (Hyperlinks?) FF81-FFF565409-65525Repeating Value (0x00)

12 f(x) Fragment type 1a1-a2 Fragment type 2 a3-a4 Fragment type Na5-a6

13 Test 1 Test 2 Test 3 Test N Fragment type 1a1-a2b1-b2c1-c2z1-z2 Fragment type 2 a3-a4b3-b4c3-c4z3-z4 Fragment type Na5-a6b5-b6c5-c6z5-z6

14 Shannon Entropy Perl Random Number Sequence a1-a2 AES Encrypted Word Document a3-a4 ASCII Text Documenta5-a6 BMP (Single Color)a7-a8

15 Shannon Entropy Shannon entropy H(X) measures uncertainty and quantifies information contained in message. http://en.wikipedia.org/wiki/Shannon_entropy Other Techniques - Hamming Weight - Index of Coincidence - Mean / Standard Deviation - Traditional pattern matching -

16 Window Size (Shannon Entropy of AES sample)

17

18

19

20 Window Size (Shannon Entropy of 4 file types)

21

22 BinMap Demo

23 Extensibility

24 Example

25 Entropy/Evaluating

26 Future Work Improve Framework –Analyze performance –Develop & improve plug-ins Improve Datasets Integrate with visualization, interaction and GUI Other identification measures Apply datamining techniques Increase size of taxonomy Code repository: http://binmap.googlecode.com

27 0x3F 0x3F 0x3F ? ? ?


Download ppt "Automated Mapping of Large Binary Objects Ben Sangster Roy Ragsdale Greg Conti"

Similar presentations


Ads by Google