Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection

Abstract

The problem of cross-platform binary code similarity detection aims at detecting whether two binary functions coming from different platforms are similar or not. It has many security applications, including plagiarism detection, malware detection, vulnerability search, etc. Existing approaches rely on approximate graphmatching algorithms, which are inevitably slow and sometimes inaccurate, and hard to adapt to a new task. To address these issues, in this work, we propose a novel neural network-based approach to compute the embedding, i.e., a numeric vector, based on the control flow graph of each binary function, then the similarity detection can be done efficiently by measuring the distance between the embeddings for two functions. We implement a prototype called Gemini. Our extensive evaluation shows that Gemini outperforms the state-of-the-art approaches by large margins with respect to similarity detection accuracy. Further, Gemini can speed up prior art's embedding generation time by 3 to 4 orders of magnitude and reduce the required training time from more than 1 week down to 30 minutes to 10 hours. Our real world case studies demonstrate that Gemini can identify significantly more vulnerable firmware images than the state-of-the-art, i.e., Genius. Our research showcases a successful application of deep learning on computer security problems.

A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

“…Machine learning based approaches. Machine learning, including deep learning, has been applied to code analysis [10], [38], [21], [62], [50], [43], [51], [29], [59], [28], [52], [27], [17]. Lee et al propose Instruction2vec for converting assembly instructions to vector representations [38]; but their instruction embedding model can only work on a single architecture.…”

“…A few works target cross-architecture binary code analysis [21], [62], [8], [67]. Some exploit the statistical aspects of code, rather than its semantics.…”

“…Some exploit the statistical aspects of code, rather than its semantics. For example, Genius [21] and Gemini [62] use some manually selected statistical features (e.g., the number of constants) to represent basic blocks, but they ignore the meaning of instructions and the dependency between them, resulting in significant loss of semantic information. INNEREYE-BB [67] uses LSTM to encode each basic block into an embedding, but it needs to train a separate instruction embedding model for each architecture.…”

“…Our solution achieves AUC = 0.90. Recent work [19], [21], [62] uses several manually selected statistic features (such as the number of instructions and the number of constants) of a basic block to represent it. However, a SVM classifier based on such features only achieves AUC = 0.85 for the same task.…”

Deep Graph Similarity Learning for Brain Data Analysis

“…Neural Networks with Structure2vec. In [106], a deep graph embedding approach is proposed for cross-platform binary code similarity detection. A Siamese architecture is applied to enable the pair-wise similarity learning, and the graph embedding network based on Structure2vec [27] is used for learning graph representations in the twin networks, which share weights with each other.…”