A hybrid static-dynamic analysis for identifying BYOVD vulnerabilities

Bring Your Own Vulnerable Driver (BYOVD) attacks abuse legitimate, signed Windows kernel drivers to perform privileged operations that would otherwise be impossible, even for users with administrative privileges. While dynamic analysis can provide runtime evidence of security-relevant driver behaviors, it is inherently limited to the code paths exercised during execution; conversely, static analysis can explore additional feasible paths but may over-approximate exploitability. In this paper, we present a hybrid static-dynamic pipeline for identifying BYOVD-relevant driver vulnerabilities. Our approach combines an extended version of IOCTLance for symbolic analysis of driver-exposed attack surfaces with an enhanced kernelmon, a DRAKVUF module, for observing runtime exploitation primitives at the hypervisor layer. We extend the state-of-the-art taxonomy of observable behaviors from 7 to 15 categories and integrate new detectors on both the static and dynamic sides. We evaluate our pipeline on 6508 signed kernel drivers and 9109 execution parents. Static analysis identifies at least one suspicious behavior in 72.1% of known vulnerable drivers and 23.2% of potentially vulnerable drivers. Dynamic analysis observes security-relevant runtime behaviors in 63.2% and 31.9% of known-vulnerable and potentially-vulnerable driver groups, respectively. By correlating static and dynamic findings, our system exposes complementary behaviors that would be missed by either technique alone and contributes to the identification of 13 previously undocumented vulnerabilities, leading to multiple CVE assignments. Our dynamic evaluation is conducted on Windows 10 without Virtualization-Based Security (VBS)/Hypervisor-Enforced Code Integrity (HVCI); therefore, the reported dynamic detection rates should not be interpreted as measurements of driver exploitability under VBS/HVCI-enabled systems.