Unleashing the power of pseudo-code for binary code similarity analysis

Abstract

Code similarity analysis has become more popular due to its significant applicantions, including vulnerability detection, malware detection, and patch analysis. Since the source code of the software is difficult to obtain under most circumstances, binary-level code similarity analysis (BCSA) has been paid much attention to. In recent years, many BCSA studies incorporating AI techniques focus on deriving semantic information from binary functions with code representations such as assembly code, intermediate representations, and control flow graphs to measure the similarity. However, due to the impacts of different compilers, architectures, and obfuscations, binaries compiled from the same source code may vary considerably, which becomes the major obstacle for these works to obtain robust features. In this paper, we propose a solution, named UPPC (Unleashing the Power of Pseudo-code), which leverages the pseudo-code of binary function as input, to address the binary code similarity analysis challenge, since pseudo-code has higher abstraction and is platform-independent compared to binary instructions. UPPC selectively inlines the functions to capture the full function semantics across different compiler optimization levels and uses a deep pyramidal convolutional neural network to obtain the semantic embedding of the function. We evaluated UPPC on a data set containing vulnerabilities and a data set including different architectures (X86, ARM), different optimization options (O0-O3), different compilers (GCC, Clang), and four obfuscation strategies. The experimental results show that the accuracy of UPPC in function search is 33.2% higher than that of existing methods.

SimCoDe-NET: Similarity Detection in Binary Code using Deep Learning Network

“…The overall effectiveness of the suggested SimCoDe-NET approach is assessed by comparing a number of criteria with the acquired results, including recall, F1 score, accuracy, and specificity. Comparing the accuracy of the SimCoDe-NET approach to earlier techniques like jTrans [14], UPPC [15], and HEBC [17], it is very high at 99.10%. The proposed SimCoDe-NET approach improves accuracy by 84.9%, 88.58%, and 93.9% in comparison to jTrans, UPPC, and HEBCS, respectively.…”

“…The effectiveness of the SimCoDe-NET technique was assessed using certain characteristics, including recall, F1 score, precision, and specificity. The comparison of the SimCoDe-NET methodology under consideration with existing methods such as jTrans [14], UPPC [15], and HEBC [17] The accuracy of the proposed method is 99.10% which is relatively high compared to the existing method. The proposed SimCoDe-NET approach improves the accuracy by 84.9%, 88.58%, and 93.9% better than jTrans, UPPC, and HEBCS respectively.…”

“…In 2022 W. Zhang, Z. Xu, Y. Xiao, and Y. Xue [15] suggested utilizing the capability of pseudocode for a comparison of binary codes. The UPPC framework is evaluated by using the vulnerabilities dataset and achieves an overall accuracy of 33.2% for binary code similarity detection.…”