EVIL: Exploiting Software via Natural Language

Abstract

Writing exploits for security assessment is a challenging task. The writer needs to master programming and obfuscation techniques to develop a successful exploit. To make the task easier, we propose an approach (EVIL) to automatically generate exploits in assembly/Python language from descriptions in natural language. The approach leverages Neural Machine Translation (NMT) techniques and a dataset that we developed for this work. We present an extensive experimental study to evaluate the feasibility of EVIL, using both automatic and manual analysis, and both at generating individual statements and entire exploits. The generated code achieved high accuracy in terms of syntactic and semantic correctness.

arXiv commentPaper accepted at the 32nd International Symposium on Software Reliability Engineering (ISSRE 2021)

References in corpus (15)

• Adam: A Method for Stochastic Optimization
• Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translation
• Language Models are Few-Shot Learners
• NLTK: The Natural Language Toolkit
• A Syntactic Neural Model for General-Purpose Code Generation
• Latent Predictor Networks for Code Generation
• A parallel corpus of Python functions and documentation strings for automated code documentation and code generation
• XNMT: The eXtensible Neural Machine Translation Toolkit
• Does BLEU Score Work for Code Migration?
• The Impact of Preprocessing on Arabic-English Statistical and Neural Machine Translation
• Meta-Evaluation of Translation Evaluation Methods: a systematic up-to-date overview
• Translation Quality Assessment: A Brief Survey on Manual and Automatic Methods
• Relevance Transformer: Generating Concise Code Snippets with Relevance Feedback
• TRANX: A Transition-based Neural Abstract Syntax Parser for Semantic Parsing and Code Generation
• Shellcode_IA32: A Dataset for Automatic Shellcode Generation