SensorRE: Provenance support for software reverse engineers

Abstract

Reverse engineering is a time-consuming process essential to software-security tasks such as malware analysis and vulnerability discovery. During the process, an engineer will follow multiple leads to determine how the software functions. The combination of time and possible explanations makes it difficult for the engineers to maintain a context of their findings within the overall task. Analytic provenance tools have demonstrated value in similarly complex fields that require open-ended exploration and hypothesis vetting. This paper introduces SensorRE, the first analytic provenance tool designed to support software reverse engineers. A semi-structured interview with experts led to the design and implementation of the system. As core components, we describe the visual interfaces and their integration within an existing software analysis tool. SensorRE automatically captures user’s sensemaking actions and provides a graph and storyboard view to support further analysis. User study results demonstrate that SensorRE is easy to use and that it improved the participants’ exploration process.