A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

Redmond, Kimberly; Luo, Lannan; Zeng, Qiang

doi:10.48550/arxiv.1812.09652

Cited by 8 publications

(13 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The study of learning-based BCSD has been inspired by recent development in natural language processing (NLP) [39,45,56], which uses real-valued vectors called embeddings to encode semantic information of words and sentences. Building upon these techniques, previous studies [14,15,24,40,43,44,51,59,[61][62][63] applied deep learning methods to binary similarity detection. Shared by many of these studies is the idea of embedding binary functions into numerical vectors, and then using vector distance to approximate the similarity between different binary functions.…”

Section: Learning-based Bcsd Approachesmentioning

confidence: 99%

“…𝛼Diff [40], for example, learns binary function embeddings directly from the sequence of raw bytes using convolutional neural network (CNN) [38]. INNEREYE [63] and RLZ2019 [51] regard instructions as words and basic blocks as sentences, and use word2vec [45] and LSTM [29] to learn basic block embeddings. SAFE [43] uses a similar approach to learn the embeddings of binary functions, while Gemini [59], VulSeeker [24], GraphEmb [44] and OrderMatters [62] use GNNs to build a graph embedding model for learning attributed control-flow graph (ACFG) of binary functions.…”

Section: Learning-based Bcsd Approachesmentioning

confidence: 99%

“…Some approaches [24,59] ignore the semantics of instructions and basic blocks, as they only use manually-selected features to represent basic blocks. Other approaches [14,15,40,43,51,61,63] neglect some or all of the structural information of binary functions, as they do not use the control-flow information, or generate instruction sequences with CFG using random walk. Finally, methods such as [44,62] learn basic block embeddings, and use GNN to learn the embedding of attributed control-flow graph (ACFG) of binary functions.…”

Section: Learning-based Bcsd Approachesmentioning

confidence: 99%

See 2 more Smart Citations

jTrans: Jump-Aware Transformer for Binary Code Similarity

Wang¹,

Qu²,

Katz³

et al. 2022

Preprint

View full text Add to dashboard Cite

Binary code similarity detection (BCSD) has important applications in various fields such as vulnerabilities detection, software component analysis, and reverse engineering. Recent studies have shown that deep neural networks (DNNs) can comprehend instructions or control-flow graphs (CFG) of binary code and support BCSD. In this study, we propose a novel Transformer-based approach, namely jTrans, to learn representations of binary code. It is the first solution that embeds control flow information of binary code into Transformer-based language models, by using a novel jump-aware representation of the analyzed binaries and a newly-designed pre-training task. Additionally, we release to the community a newly-created large dataset of binaries, BinaryCorp, which is the most diverse to date. Evaluation results show that jTrans outperforms state-of-the-art (SOTA) approaches on this more challenging dataset by 30.5% (i.e., from 32.0% to 62.5%). In a real-world task of known vulnerability searching, jTrans achieves a recall that is 2X higher than existing SOTA baselines. CCS CONCEPTS• Security and privacy → Software reverse engineering; • Computing methodologies → Machine learning.

show abstract

Section: Learning-based Bcsd Approachesmentioning

confidence: 99%

Section: Learning-based Bcsd Approachesmentioning

confidence: 99%

Section: Learning-based Bcsd Approachesmentioning

confidence: 99%

See 1 more Smart Citation

jTrans: Jump-Aware Transformer for Binary Code Similarity

Wang¹,

Qu²,

Katz³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Asm2Vec [10] leverages a modified version of PV-DM model to solve the obfuscation and optimization issues in a clone search. Zuo et al [73] and Redmond et al [50] solve the binary similarity problem by NLP techniques when the same file is compiled in different architectures. SAFE [37] proposes a combination of skip-gram and RNN self-attention model to learn the embeddings of the functions from binary files to find the similarities.…”

Section: Binary Analysis With Embeddingmentioning

confidence: 99%

“…Natural Language Processing (NLP) techniques are applied to automate challenging tasks in natural language and text processing [48]. Later, NLP techniques have been applied for security as well, such as in network traffic [49] and vulnerability analysis [50]. Such applications leverage word [39] or paragraph [30] embedding techniques to learn the vector representations of the text.…”

Section: Introductionmentioning

confidence: 99%

FastSpec: Scalable Generation and Detection of Spectre Gadgets Using Neural Embeddings

Tol¹,

Gülmezoğlu²,

Yurtseven³

et al. 2020

Preprint

View full text Add to dashboard Cite

Several techniques have been proposed to detect vulnerable Spectre gadgets in widely deployed commercial software. Unfortunately, detection techniques proposed so far rely on hand-written rules which fall short in covering subtle variations of known Spectre gadgets as well as demand a huge amount of time to analyze each conditional branch in software. Since it requires arduous effort to craft new gadgets manually, the evaluations of detection mechanisms are based only on a handful of these gadgets.In this work, we employ deep learning techniques for automated generation and detection of Spectre gadgets. We first create a diverse set of Spectre-V1 gadgets by introducing perturbations to the known gadgets. Using mutational fuzzing, we produce a data set with more than 1 million Spectre-V1 gadgets which is the largest Spectre gadget data set built to date. Next, we conduct the first empirical usability study of Generative Adversarial Networks (GANs) for creating assembly code without any human interaction. We introduce SpectreGAN which leverages masking implementation of GANs for both learning the gadget structures and generating new gadgets. This provides the first scalable solution to extend the variety of Spectre gadgets.Finally, we propose FastSpec which builds a classifier with the generated Spectre gadgets based on the novel high dimensional Neural Embedding technique BERT. For case studies, we demonstrate that FastSpec discovers potential gadgets in OpenSSL libraries and Phoronix benchmarks. Further, Fast-Spec offers much greater flexibility and much faster classification compared to what is offered by the existing tools. Therefore FastSpec can be used for gadget detection in largescale projects.

show abstract

Cross-Inlining Binary Function Similarity Detection

Jia,

Fan,

et al. 2024

Proceedings of the IEEE/ACM 46th International Conference on Software Engineering

View full text Add to dashboard Cite

Binary function similarity detection plays an important role in a wide range of security applications. Existing works usually assume that the query function and target function share equal semantics and compare their full semantics to obtain the similarity. However, we find that the function mapping is more complex, especially when function inlining happens.In this paper, we will systematically investigate cross-inlining binary function similarity detection. We first construct a crossinlining dataset by compiling 51 projects using 9 compilers, with 4 optimizations, to 6 architectures, with 2 inlining flags, which results in two datasets both with 216 combinations. Then we construct the cross-inlining function mappings by linking the common source functions in these two datasets. Through analysis of this dataset, we find that three cross-inlining patterns widely exist while existing work suffers when detecting cross-inlining binary function similarity. Next, we propose a pattern-based model named CI-Detector for cross-inlining matching. CI-Detector uses the attributed CFG to represent the semantics of binary functions and GNN to embed binary functions into vectors. CI-Detector respectively trains a model for these three cross-inlining patterns. Finally, the testing pairs are input to these three models and all the produced similarities are aggregated to produce the final similarity. We conduct several experiments to evaluate CI-Detector. Results show that CI-Detector can detect cross-inlining pairs with a precision of 81% and a recall of 97%, which exceeds all state-of-the-art works. CCS CONCEPTS• Software and its engineering → Software reverse engineering; Search-based software engineering.

show abstract

A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

Cited by 8 publications

References 27 publications

jTrans: Jump-Aware Transformer for Binary Code Similarity

jTrans: Jump-Aware Transformer for Binary Code Similarity

FastSpec: Scalable Generation and Detection of Spectre Gadgets Using Neural Embeddings

Cross-Inlining Binary Function Similarity Detection

Contact Info

Product

Resources

About