A Method to Evaluate Binary Code Comparison Tools

Arutunian, Mariam; Hovhannisyan, Hripsime; Vardanyan, Vahagn; Sargsyan, Sevak; Kurmangaleev, Shamil; Aslanyan, Hayk

doi:10.1109/ivmem53963.2021.00006

Cited by 4 publications

(3 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The proposed SimCoDe-NET approach improves accuracy by 84.9%, 88.58%, and 93.9% in comparison to jTrans, UPPC, and HEBCS, respectively. 90% detection accuracy for the frame and method detection accuracy were obtained by using well-known techniques as InnerEYE [23], BinDiff [24], SAFE [25], and jTrans [14]. The SimCoDe-NET is assessed.…”

Section: Similarity Detection Accuracymentioning

confidence: 99%

SimCoDe-NET: Similarity Detection in Binary Code using Deep Learning Network

Poornima,

Mahalakshmi

2023

IJEER

View full text Add to dashboard Cite

Binary code similarity detection is a fundamental task in the field of computer binary security. However, code similarity is crucial today because of the prevalence of issues like plagiarism, code cloning, and recycling in software due to the ongoing increase of software scale. To resolve these issues, a novel SIMilarity detection in binary COde using DEep learning NETwork (SimCoDe-NET) has been proposed. Initially, op-code features are extracted from the input data by using reverse engineering process and the opcode embedding is generated using N-skip gram method. The extracted features are fed into Bi-GRU neural network for classifying the similarity of the binary codes. The Bi-GRU neural network compares two data samples in feature space to identify whether they belong to similar data or non-similar data. The SimCoDe-NET framework is evaluated by using generated dataset to assess the efficiency of this method. The efficacy of the proposed SimCoDe-NET framework is assessed in terms of precision, accuracy, sensitivity, recall, similarity detection time and similarity detection rate. The accuracy of the proposed method is 99.10% which is relatively high compared to the existing method. The proposed SimCoDe-NET approach improves the accuracy by 84.9%, 88.58%, and 93.9% better than jTrans, UPPC, and HEBCS respectively.

show abstract

Section: Similarity Detection Accuracymentioning

confidence: 99%

SimCoDe-NET: Similarity Detection in Binary Code using Deep Learning Network

Poornima,

Mahalakshmi

2023

IJEER

View full text Add to dashboard Cite

show abstract

“…Формат BinExport позволяет хранить граф потока управления и граф вызова функций, которые используются утилитой BinDiff для вычисления расстояния между исполнимыми файлами. Выбор BinDiff обоснован, с одной стороны, тем, что, как показывают результаты исследования [20], подход, используемый в BinDiff, дает высокую точность сравнения; с другой стороны, в настоящий момент формат BinExport поддерживается популярными дизассемблерами IDA Pro [21], Ghydra [22] и Binary Ninja [23]. В частности, соответствующие плагины для IDA Pro и Ghydra позволяют автоматизировать процесс выгрузки данных в формате BinExport.…”

Section: начальное описание программunclassified

“…4) -соответствующие показатели вносят наименьший вес в принятие решения (если не учитывать показатель ssdeep, вес которого минимален). Вектор показателей также может быть расширен за счет использования других средств сравнения файлов исполнимого кода, например, в дополнение к BinDiff может быть использовано средство BCC, предложенное в[41] и показавшее, согласно[20], наибольшую точность сравнения бинарного кода. Дальнейшим направлением исследования является оптимизация набора характеристик, применение характеристик, получаемых средствами динамического анализа программ, например, средствами символьного анализа, исследование качества предлагаемого метода для оценки похожести программ из набора, отличного от coreutils, а также оценка качества обфусцирующих преобразований с помощью построенных классификаторов.…”

unclassified

A Method to Evaluate Program Similarity Using Machine Learning Methods

Borisov¹,

Kosolapov²

2022

Proceedings of ISP RAS

View full text Add to dashboard Cite

The problem of constructing an algorithm for comparing two executable files is considered. The algorithm is based on the construction of similarity features vector for a given pair of programs. This vector is then used to decide on the similarity or dissimilarity of programs using machine learning methods. Similarity features are built using algorithms of two types: universal and specialized. Universal algorithms do not take into account the format of the input data (values of fuzzy hash functions, values of compression ratios). Specialized algorithms work with executable files and analyze machine code (using disassemblers). A total of 15 features were built: 9 features of the first type and 6 of the second. Based on the constructed training set of similar and dissimilar program pairs, 7 different binary classifiers were trained and tested. To build the training set, coreutils programs were used. The results of the experiments showed high accuracy of models based on random forest and k nearest neighbors. It was also found that the combined use of features of both types can improve the accuracy of classification.

show abstract