Atlantis: Improving the Analysis and Visualization of Large Assembly Execution Traces

Published in The International Conference on Software Maintenance and Evolution (ICSME), 2017

Assembly execution trace analysis is an effective approach for discovering potential software vulnerabilities. However, the size of the execution traces and the lack of source code makes this a manual, labor-intensive process. Instead of browsing billions of instructions one by one, software security analysts need higher-level information that can provide an overview of the execution of a program to assist in the identification of patterns of interest. The tool we present in this paper, Atlantis, is our trace analysis environment for multi-gigabyte assembly traces, and it contains a number of new features that make it particularly successful in meeting this goal. The contributions of this continuous work fall into three main categories: a) the ability to efficiently reconstruct and navigate the memory state of a program at any point in a trace; b) the ability to reconstruct and navigate functions and processes; and c) a powerful search facility to query and navigate traces. These contributions are not only novel for Atlantis but also for the field of assembly trace analysis. Software is becoming increasingly complex and many applications are designed as collaborative systems or modules interacting with each other, which makes the discovery of vulnerabilities extremely difficult. With the novel features we describe in this paper, our tool extends the security analyst’s ability to investigate vulnerabilities of real-world large execution traces and can lay the groundwork for supporting trace analysis of interacting programs in the future.


Multi-component signal processing against continue-wave background

Published in Journal of Data Acquisition & Processing, 2006

The algorithm for multi-component signal processing against the background of linear frequency modulated continuous wave(LFMCW) in electronic reconnaissance is discussed.The pulse signals can be detected from the continue-wave background by analyzing every time slice of the short-time Fourier transform exerted on the received signal.By filtering the LFM pulse signals and remaining the component of the CW signal,the periodic time-frequency curve of LFMCW radar signal can be obtained.According to characters of the spectrum of the time-frequency curve,the main parameters of the LFMCW signal can be estimated.Then,by filtering LFMCW component from pulse signals,the parameters of the LFM pulse signals can be estimated by the relative algorithms.Simulation results indicate that the method can accurately estimate the parameters of LFMCW signals and LFM pulse signals.When SNR of the LFMCW signals is higher than(-8 dB) and its power is 6 dB lower compared with LFM pulse signals,the performance of the algorithm is stable and the precision is good.


Parameters Estimation of LFMCW Signals [J]

Published in Modern Radar, 2006

This new algorithm for estimating the parameters of LFMCW signals is presented.The Time-Frequency curve can be obtained by short-time Fourier transform.According to the periodic characters of the Time-Frequency curve the characters of the frequency spectrum of the curve can be found.The relationship between parameters of signals and spectrum-lines’ positions or amplitudes can be confirmed.Then the main parameters of signal can be obtained.Simulation results prove that the method can estimate the parameters of LFMCW signals accurately.When the signal-noise ratio is higher than-8 dB,the performance of the algorithm is stable and the precision of the algorithm is good.