Binary Code Similarity Detection: Retrospective Review and Future Directions
Source abstract
Abstract
Binary Code Similarity Detection (BCSD) is vital for vulnerability discovery, malware detection, and software security, especially when source code is unavailable. Yet, it faces challenges from semantic loss, recompilation variations, and obfuscation. Recent advances in artificial intelligence—particularly natural language processing (NLP), graph representation learning (GRL), and large language models (LLMs)—have markedly improved accuracy, enabling better recognition of code variants and deeper semantic understanding. This paper presents a comprehensive review of 82 studies published between 1975 and 2025, systematically tracing the historical evolution of BCSD and analyzing the progressive incorporation of artificial intelligence (AI) techniques. Particular emphasis is placed on the role of LLMs, which have recently emerged as transformative tools in advancing semantic representation and enhancing detection performance. The review is organized around five central research questions: (1) the chronological development and milestones of BCSD; (2) the construction of AI-driven technical roadmaps that chart methodological transitions; (3) the design and implementation of general analytical workflows for binary code analysis; (4) the applicability, strengths, and limitations of LLMs in capturing semantic and structural features of binary code; and (5) the persistent challenges and promising directions for future investigation. By synthesizing insights across these dimensions, the study demonstrates how LLMs reshape the landscape of binary code analysis, offering unprecedented opportunities to improve accuracy, scalability, and adaptability in real-world scenarios. This review not only bridges a critical gap in the existing literature but also provides a forward-looking perspective, serving as a valuable reference for researchers and practitioners aiming to advance AI-powered BCSD methodologies and applications.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Software Engineering Research · Web Application Security Vulnerabilities
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (100+)
Show source-provided references
1. A survey of binary code similarity10.1145/3446371 ↗
2. VulSeeker: a semantic learning based vulnerability seeker for cross-platform binary
3. Neural network-based graph embedding for cross-platform binary code similarity detection
4. FirmUp: precise static detection of common vulnerabilities in firmware10.1145/3296957.3177157 ↗
5. Binarm: scalable and efficient detection of vulnerabilities in firmware images of intelligent electronic devices
6. αDiff: cross-version binary code similarity detection with DNN
7. Bruschi · Detection of intrusions and malware & vulnerability assessment · 2006 · 129
8. Control flow-based malware VariantDetection10.1109/TDSC.2013.40 ↗
9. Lines of malicious code: insights into the malicious software industry
10. Towards automatic software lineage inference
11. Ming · ICT systems security and privacy protection · 2015 · 41610.1007/978-3-319-18467-8_28 ↗
12. Advances in natural language processing10.1126/science.aaa8685 ↗
13. Manning · Foundations of statistical natural language processing · 1999
14. Graph representation learning: a survey10.1017/ATSIP.2020.13 ↗
15. Wang X, Jiang Y, Bach N, Wang T, Huang Z, Huang F, et al. Automated concatenation of embeddings for structured prediction. arXiv:2010.05006. 2020.10.18653/v1/2021.acl-long.206 ↗
16. DeepBinDiff: learning program-wide code representations for binary diffing
17. Fu · Int J Intelligent Sys · 2022 · 37 · 508210.1002/int.22752 ↗
18. Multilevel graph matching networks for deep graph similarity learning10.1109/TNNLS.2021.3102234 ↗
19. How could neural networks understand programs?
20. Codee: a tensor embedding scheme for binary code search10.1109/TSE.2021.3056139 ↗
21. Graph neural networks for social recommendation
22. BinDeep: a deep learning approach to binary code similarity detection10.1016/j.eswa.2020.114348 ↗
23. Extracting conditional formulas for cross-platform bug search
24. Gao · Information and communications security · 2008 · 238
25. Binary function clustering using semantic hashes
26. Fast location of similar code fragments using semantic ‘juice’
27. Semantics-based obfuscation-resilient binary code similarity comparison with applications to software plagiarism detection
28. CLAP: learning transferable binary code representations with natural language supervision
29. Binary code similarity detection via LLM-based source code conversion10.1109/JIOT.2025.3579231 ↗
30. Lu S, Guo D, Ren S, Huang J, Svyatkovskiy A, Blanco A, et al. CodeXGLUE: a machine learning benchmark dataset for code understanding and generation. arXiv:2102.04664. 2021.
31. Chen M, Tworek J, Jun H, Yuan Q, de Oliveira Pinto HP, Kaplan J, et al. Evaluating large language models trained on code. arXiv:2107.03374. 2021.
32. A systematic evaluation of large language models of code
33. Rozière B, Gehring J, Gloeckle F, Sootla S, Gat I, Tan XE, et al. Code llama: open foundation models for code. arXiv:2308.12950. 2023.
34. Li R, Allal LB, Zi Y, Muennighoff N, Kocetkov D, Mou C, et al. Starcoder: may the source be with you! arXiv:2305.06161. 2023.
35. How machine learning is solving the binary function similarity problem
36. Automated conformance testing for JavaScript engines via deep compiler fuzzing
37. CodaMosa: escaping coverage plateaus in test generation with pre-trained large language models
38. Fill in the blank: context-aware automated text input generation for mobile GUI testing
39. Large language models are zero-shot fuzzers: fuzzing deep-learning libraries via large language models
40. VulRepair: a T5-based automated software vulnerability repair
41. Automated repair of programs from large language models
42. Retrieval-based prompt selection for code-related few-shot learning
43. Cheshkov A, Zadorozhny P, Levichev R. Evaluation of ChatGPT model for vulnerability detection. arXiv:2304.07232. 2023.
44. Software vulnerability detection using large language models
45. SCALE: constructing structured natural language comment trees for software vulnerability detection
46. ReSym: harnessing LLMs to recover variable and data structure symbols from stripped binaries
47. Source code foundation models are transferable binary analysis knowledge bases
48. Unleashing the power of generative model in recovering variable names from stripped binary
49. Beyond classification: inferring function names in stripped binaries via domain adapted LLMs
50. Compressing differences of executable code
51. Structural comparison of executable objects
52. Graph-based comparison of executable objects (English version)
53. Cross-architecture binary semantics understanding via similar code comparison
54. BinSequence: fast, accurate and scalable binary code reuse detection
55. SPAIN: security patch analysis for binaries towards understanding the pain and pills
56. Towards robust instruction-level trace alignment of binary code
57. Tracelet-based code search in executables10.1145/2666356.2594343 ↗
58. Leveraging semantic signatures for bug search in binary programs
59. Cross-architecture bug search in binary executables
60. discovRE: efficient cross-architecture identification of bugs in binary code
61. Statistical similarity of binaries10.1145/2980983.2908126 ↗
62. Scalable graph-based bug search for firmware images
63. BinGo: cross-architecture cross-OS binary search
64. Similarity of binaries through re-optimization
65. Asm2Vec: boosting static representation robustness for binary clone search against code obfuscation and compiler optimization
66. Safe: self-attentive function embeddings for binary similarity
67. Large-scale malware indexing using function-call graphs
68. MutantX-S: scalable malware clustering based on static features
69. Binary executable file similarity calculation using function matching10.1007/s11227-016-1941-2 ↗
70. The source code control system10.1109/TSE.1975.6312866 ↗
71. Delta storage for arbitrary non-text files
72. Recent advances in intrusion detection
73. Rendezvous: a search engine for binary code
74. Tencent. BinaryAI Python SDK [Internet]. [cited 2025 Sep 9]. Available from: https://github.com/binaryai/sdk.
75. jTrans: jump-aware transformer for binary code similarity detection
76. Zhu W, Wang H, Zhou Y, Wang J, Sha Z, Gao Z, et al. kTrans: knowledge-aware transformer for binary code embedding. arXiv:2308.12659. 2023.
77. Code is not natural language: unlock the power of semantics-oriented graph representation for binary code similarity detection
78. Alrabaee · ACM Trans Priv Secur · 2018 · 21 · 110.1145/3175492 ↗
79. Graph matching networks for learning the similarity of graph structured objects
80. Binary similarity detection using machine learning
81. Shirani · Detection of intrusions and malware, and vulnerability assessment · 2017 · 30110.1007/978-3-319-60876-1_14 ↗
82. Kam1n0: MapReduce-based assembly clone search for reverse engineering
83. BinClone: detecting code clones in malware
84. Binsign: fingerprinting binary functions to support automated analysis of code executables
85. Beyond precision and recall: understanding uses (and misuses) of similarity hashes in binary analysis
86. Malware similarity and a new fuzzy hash: compound Code Block Hash (CCBHash)10.1016/j.cose.2024.103856 ↗
87. Forensic malware analysis: the value of fuzzy hashing algorithms in identifying similarities
88. Dullien T. Searching statically-linked vulnerable library functions in executable code [Internet]. [cited 2025 Sep 9]. Available from: https://googleprojectzero.blog.
89. Investigating graph embedding neural networks with unsupervised features extraction for binary analysis
90. Order matters: semantic-aware neural networks for binary code similarity detection
91. Pei K, Xuan Z, Yang J, Jana S, Ray B. Trex: learning execution semantics from micro-traces for binary similarity. arXiv:2012.08680. 2020.
92. Asteria: deep learning-based AST-encoding for cross-platform binary code similarity detection
93. PalmTree: learning an assembly language model for instruction embedding
94. Practical binary code similarity detection with BERT-based transferable similarity learning
95. Improving cross-platform binary analysis using representation learning via graph alignment
96. VulHawk: cross-architecture vulnerability detection with entropy-based binary code search
97. Collyer J, Watson T, Phillips I. FASER: binary code similarity search through the use of intermediate representations. arXiv:2310.03605. 2023.
98. Asteria-pro: enhancing deep learning-based binary code similarity detection by incorporating domain knowledge
99. sem2vec: semantics-aware assembly tracelet embedding
100. Feng Z, Guo D, Tang D, Duan N, Feng X, Gong M, et al. CodeBERT: a pre-trained model for programming and natural languages. arXiv:2002.08155. 2020.10.18653/v1/2020.findings-emnlp.139 ↗