000148140 001__ 148140
000148140 005__ 20250114155432.0
000148140 0247_ $$2doi$$a10.1016/j.future.2024.107602
000148140 0248_ $$2sideral$$a141589
000148140 037__ $$aART-2025-141589
000148140 041__ $$aeng
000148140 100__ $$aCarrillo-Mondéjar, Javier$$uUniversidad de Zaragoza
000148140 245__ $$aIdentifying runtime libraries in statically linked linux binaries
000148140 260__ $$c2025
000148140 5060_ $$aAccess copy available to the general public$$fUnrestricted
000148140 5203_ $$aVulnerabilities in unpatched applications can originate from third-party dependencies in statically linked applications, as they must be relinked each time to take advantage of libraries that have been updated to fix any vulnerability. Despite this, malware binaries are often statically linked to ensure they run on target platforms and to complicate malware analysis. In this sense, identification of libraries in malware analysis becomes crucial to help filter out those library functions and focus on malware function analysis. In this paper, we introduce MANTILLA, a system for identifying runtime libraries in statically linked Linux-based binaries. Our system is based on radare2 to identify functions and extract their features (independent of the underlying architecture of the binary) through static binary analysis and on the K-nearest neighbors supervised machine learning model and a majority rule to predict final values. MANTILLA is evaluated on a dataset consisting of binaries built for different architectures (MIPSeb, ARMel, Intel x86, and Intel x86-64) and different runtime libraries (uClibc, glibc, and musl), achieving very high accuracy. We also evaluate it in two case studies. First, using a dataset of binary files belonging to the binutils collection and second, using an IoT malware dataset. In both cases, good accuracy results are obtained both in terms of runtime library detection (94.4% and 95.5%, respectively) and architecture identification (100% and 98.6%, respectively).
000148140 536__ $$9info:eu-repo/grantAgreement/ES/DGA/T21-23R$$9info:eu-repo/grantAgreement/EUR/MICINN/TED2021-131115A-I00
000148140 540__ $$9info:eu-repo/semantics/openAccess$$aby-nc$$uhttp://creativecommons.org/licenses/by-nc/3.0/es/
000148140 655_4 $$ainfo:eu-repo/semantics/article$$vinfo:eu-repo/semantics/publishedVersion
000148140 700__ $$0(orcid)0000-0001-7982-0359$$aRodríguez, Ricardo J.$$uUniversidad de Zaragoza
000148140 7102_ $$15007$$2570$$aUniversidad de Zaragoza$$bDpto. Informát.Ingenie.Sistms.$$cÁrea Lenguajes y Sistemas Inf.
000148140 773__ $$g164 (2025), 107602 [11 pp.]$$pFuture gener. comput. syst.$$tFuture Generation Computer Systems-The International Journal of Grid Computing Theory Methods and Applications$$x0167-739X
000148140 8564_ $$s1596134$$uhttps://zaguan.unizar.es/record/148140/files/texto_completo.pdf$$yVersión publicada
000148140 8564_ $$s2769237$$uhttps://zaguan.unizar.es/record/148140/files/texto_completo.jpg?subformat=icon$$xicon$$yVersión publicada
000148140 909CO $$ooai:zaguan.unizar.es:148140$$particulos$$pdriver
000148140 951__ $$a2025-01-13-14:28:31
000148140 980__ $$aARTICLE