The DMC Tool and Process

The DMC tool detects two types of malicious code: (1) exfiltration of sensitive data and (2) timebombs, logic bombs, remote-access Trojans (RATs), and other similar malicious code. We chose to build the tool on LLVM over other options to better scale to real-world programs. While our tool focuses on C/C++ codebases, it can also support other languages that compile to LLVM IR. Additionally, the tool performs all analysis at the level of LLVM intermediate representation (IR), and has some support for binaries via lifting to LLVM IR.

The tool does use taint analysis to track the flow of sensitive and auxiliary information, but we used auxiliary information (e.g., if a filename was specified by a local user or if it came from network data) to help separate benign flows from malicious flows. Even if there is a benign flow from a given source to a given sink, we still look for additional flows from the same source to the same sink in potentially malicious parts of the codebase. For each flow, we generate a witness trace and identify any restrictions on what data a potential attacker can pass to sensitive sinks (e.g., reading files only in a single folder).

The tool only uses static analysis to analyze all possible executions abstractly, so there’s no need to execute the potentially malicious code as in dynamic analysis. In principle, static analysis can detect all possible malicious flows, but it may also report false positives. Further human analysis is required to compare the tool’s output flows with the program’s intended functionality to verify if the code is actually malicious. The DMC tool produces output that concisely and precisely characterizes the potentially malicious behaviors of the codebase, so that a human analyst can quickly and accurately determine whether the behavior is benign or malicious.