Neural Machine Translation Inspired Binary Code Similarity Comparison beyond Function Pairs

Abstract

Binary code analysis allows analyzing binary code without having access to the corresponding source code. A binary, after disassembly, is expressed in an assembly language. This inspires us to approach binary analysis by leveraging ideas and techniques from Natural Language Processing (NLP), a fruitful area focused on processing text of various natural languages. We notice that binary code analysis and NLP share many analogical topics, such as semantics extraction, classification, and code/text comparison. This work thus borrows ideas from NLP to address two important code similarity comparison problems. (I) Given a pair of basic blocks of different instruction set architectures (ISAs), determining whether their semantics is similar; and (II) given a piece of code of interest, determining if it is contained in another piece of code of a different ISA. The solutions to these two problems have many applications, such as cross-architecture vulnerability discovery and code plagiarism detection.Despite the evident importance of Problem I, existing solutions are either inefficient or imprecise. Inspired by Neural Machine Translation (NMT), which is a new approach that tackles text across natural languages very well, we regard instructions as words and basic blocks as sentences, and propose a novel cross-(assembly)-lingual deep learning approach to solving Problem I, attaining high efficiency and precision. Many solutions have been proposed to determine whether two pieces of code, e.g., functions, are equivalent (called the equivalence problem), which is different from Problem II (called the containment problem). Resolving the cross-architecture code containment problem is a new and more challenging endeavor. Employing our technique for crossarchitecture basic-block comparison, we propose the first solution to Problem II. We implement a prototype system INNEREYE and perform a comprehensive evaluation. A comparison between our approach and existing approaches to Problem I shows that our system outperforms them in terms of accuracy, efficiency and scalability. The case studies applying the system demonstrate that our solution to Problem II is effective. Moreover, this research showcases how to apply ideas and techniques from NLP to largescale binary code analysis.

A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

“…A few works target cross-architecture binary code analysis [21], [62], [8], [67]. Some exploit the statistical aspects of code, rather than its semantics.…”

“…For example, Genius [21] and Gemini [62] use some manually selected statistical features (e.g., the number of constants) to represent basic blocks, but they ignore the meaning of instructions and the dependency between them, resulting in significant loss of semantic information. INNEREYE-BB [67] uses LSTM to encode each basic block into an embedding, but it needs to train a separate instruction embedding model for each architecture. Instead, we build a uniform cross-architecture instruction embedding model that tolerates the syntactic differences across architectures.…”

“…We train our model using basic blocks that are open-sourced by our prior work 2 [67], consisting of 202,252 semantically similar basic-block pairs. This dataset is prepared using OpenSSL (v1.1.1-pre1) and four popular Linux packages, including coreutils (v8.29), findutils (v4.6.0), diffutils (v3.6), and binutils (v2.30).…”

“…A quick inspection shows that the instructions of different ISAs overlap together. Our prior work [67] learns the mono-architecture instruction embeddings, where the instruction embeddings are architecture-specific (i.e., separate instruction embedding models need to be trained for each architecture), and the embeddings of different ISAs exist in different vector spaces (see Figure 9 in [67]). Instead, this work establishes a cross-architecture instruction embedding model, which learns embeddings in the same vector space.…”

“…We next conduct the cross-architecture basic-block similarity comparison task to evaluate the quality of the learned model. We divide the dataset which contains 202,252 similar basic-block pairs into two parts: 90% of them are used for training; 10% of them and another 20,000 dissimilar block pairs (selected from the dataset open-sourced by our prior work [67]) for testing. Note that we only need similar block pairs for training; and for testing both similar and dissimilar pairs are used.…”