@phdtesis{cohenthesis,title={Apprentissage de Représentations de Graphes pour la Cybersécurité},url={},author={Cohen, Roxane},year={2025},note={},dimensions={true},}
Past
2022
Advisor
Towards 1-day Vulnerability Detection using Semantic Patch Signatures
Alexis Challande
2022
Thèse de doctorat dirigée par Renault, Guénaël Informatique Institut polytechnique de Paris 2022
To maintain the security of information systems, deploying the proposed updates as soon as they are available is a good practice encouraged by all the computer security actors. Indeed, the exploitation of 1-day vulnerabilities (so called because a patch has been available for at least 1 day) can be devastating as EternalBlue or Shellshock have illustrated.The objective of this thesis is to propose methods and their practical application to detect if these patches are well applied at the lowest level, i.e. in the binary code. This is essential to have a reliable view of a system protection.To achieve this goal, we have established several milestones. The first one consists in an in-depth study of a typical patch, before formalizing a framework for searching for them at the scale of a complete system.We then propose the implementation of a software solution that automatically builds semantic signatures of vulnerability patches and searches for these signatures in filesystems.Finally, we test this solution in real conditions (i.e. detection of patches in images of the Android operating system) and show the relevance of our approach.
@phdtesis{challandethesis,title={Towards 1-day Vulnerability Detection using Semantic Patch Signatures},url={http://www.theses.fr/2022IPPAX096},author={Challande, Alexis},year={2022},note={Thèse de doctorat dirigée par Renault, Guénaël Informatique Institut polytechnique de Paris 2022},dimensions={true},}
2021
Advisor
Binary Diffing as a Network Alignment Problem
Elie Mengin
2021
Thèse de doctorat dirigée par Rossi, Fabrice Mathematiques appliquees Paris 1 2021
In this thesis, we address the problem of binary diffing, i.e. the problem of finding the best possible one-to-one correspondence between the functions of two programs in binary form. This problem is a major challenge in several fields of computer security since it automatically designates to an analyst the pieces of code that might have been previously analyzed among other programs. We propose a quite natural formulation of the binary diffing problem as a particular instance of a graph edit problem over the call graphs of the programs. Through this formulation, the quality of the function mapping is evaluated simultaneously with respect to both the function content similarity and the function calls consistency. We prove that this versatile formulation is in fact equivalent to the well studied network alignment problem, which enables us to leverage common optimization techniques. Following previous works, we propose a solving strategy based on max-product belief propagation, and introduce QBinDiff, a network alignment solver that outperforms other state-of-the-art methods in almost all instances. We finally show that our approach outperforms existing diffing tools, and that the matching strategy has more influence on the quality the solution than the measure of function similarity.
@phdthesis{menginthesis,title={Binary Diffing as a Network Alignment Problem},author={Mengin, Elie},year={2021},note={Thèse de doctorat dirigée par Rossi, Fabrice Mathematiques appliquees Paris 1 2021},dimensions={true},}
2020
Jury
L’usage de l’exécution symbolique pour la déobfuscation binaire en milieu industriel
Jonathan Salwan
Université Grenoble Alpes , Feb 2020
Thèse de doctorat dirigée par Potet, Marie-Laure et Bardin, Sébastien Mathématiques et informatique Université Grenoble Alpes 2020
This doctoral work has been done in an industrial environment where the main activities were reverse engineering for vulnerability research and security properties verification on binary programs. The first part of this doctoral work focuses on the collection and sharing of the industrial problems when analyzing binary programs. Based on these issues, a binary dynamic analysis framework has been developed and formalized. Real examples of use are then presented, such as the detection of opaque predicates in branch conditions. Finally, a new automatic approach for deobfuscation of binary code protected by virtualization is presented combining features of the framework as well as those of other tools.
@phdthesis{salwanthesis,url={http://www.theses.fr/2020GRALM005},title={L’usage de l’exécution symbolique pour la déobfuscation binaire en milieu industriel},author={Salwan, Jonathan},year={2020},month=feb,school={Université Grenoble Alpes},note={Thèse de doctorat dirigée par Potet, Marie-Laure et Bardin, Sébastien Mathématiques et informatique Université Grenoble Alpes 2020},dimensions={true},}
