GrizzlyBay: Retroactive SBOM with Automated Identification for Legacy Binaries

Software Bill of Material (SBOM) has been actively used recently to improve the security and transparency of software supply chains. This information is often created when the corresponding software is being developed. Several software platforms with rich information of package management can support automatic generation of SBOM. However, there is a limited support for native binaries whose machine code does not have much metadata included. Towards this challenge for legacy binaries, we propose a new approach called GrizzlyBay to create an SBOM that supports automated identification of software names, version numbers, and corresponding vulnerabilities using novel locality-sensitive hashing of abstract instructions and program structures. We demonstrate our approach offers the identification of software information with high accuracy on par with Ghidra, a leading software reversing engineering software, but with a higher reliability, faster speed, and more concise representation of software.