BlockMatch: A Fine-Grained Binary Code Similarity Detection Approach Using Contrastive Learning for Basic Block Matching
Source abstract
Abstract
Binary code similarity detection (BCSD) plays a vital role in computer security and software engineering. Traditional BCSD methods heavily rely on specific features and necessitate rich expert knowledge, which are sensitive to code alterations. To improve the robustness against minor code alterations, recent research has shifted towards machine learning-based approaches. However, existing BCSD approaches mainly focus on function-level matching and face challenges related to large batch optimization and high quality sample selection at the basic block level. To overcome these challenges, we propose BlockMatch, a novel fine-grained BCSD approach that leverages natural language processing (NLP) techniques and contrastive learning for basic block matching. We treat instructions of basic blocks as a language and utilize a DeBERTa model to capture relative position relations and contextual semantics for encoding instruction sequences. For various operands in binary code, we propose a root operand model pre-training task to mitigate semantic missing of unseen operands. We then employ a mean pooling layer to generate basic block embeddings for detecting binary code similarity. Additionally, we propose a contrastive training framework, including a block augmentation model to generate high-quality training samples, improving the effectiveness of model training. Inspired by contrastive learning, we adopt the NT-Xent loss as our objective function, which allows larger sample sizes for model training and mitigates the convergence issues caused by limited local positive/negative samples. By conducting extensive experiments, we evaluate BlockMatch and compare it against state-of-the-art approaches such as PalmTree and SAFE. The results demonstrate that BlockMatch achieves a recall@1 of 0.912 at the basic block level under the cross-compiler scenario (pool size = 10), which outperforms PalmTree (0.810) and SAFE (0.798). Furthermore, our ablation study shows that the proposed contrastive training framework and root operand model pre-training task help our model achieve superior performance.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Software Engineering Research · Software Testing and Debugging Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Computer, National University of Defense Technology, Changsha 410073, China
Funding
the National University of Defense Technology Research Project · the National Natural Science Foundation China · the HUNAN Province Natural Science Foundation · the National Key Research and Development Program of China
References (58)
Show source-provided references
1. Semantics-based obfuscation-resilient binary code similarity comparison with applications to software and algorithm plagiarism detection10.1109/TSE.2017.2655046 ↗
2. Ming, J., Xu, D., Jiang, Y., and Wu, D. (2017, January 16–18). Binsim: Trace-based semantic binary diffing via system call sliced segment equivalence checking. Proceedings of the 26th USENIX Security Symposium (USENIX Security 17), Vancouver, BC, Canada.
3. Control flow-based malware variantdetection10.1109/TDSC.2013.40 ↗
4. Hu, X., Chiueh, T.C., and Shin, K.G. (2009, January 9–13). Large-scale malware indexing using function-call graphs. Proceedings of the 16th ACM Conference on Computer and Communications Security, Chicago, IL, USA.10.1145/1653662.1653736 ↗
5. Bayer, U., Comparetti, P.M., Hlauschek, C., Kruegel, C., and Kirda, E. (2009, January 8–11). Scalable, behavior-based malware clustering. Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.
6. Kruegel, C., Kirda, E., Mutz, D., Robertson, W., and Vigna, G. (2005, January 7–9). Polymorphic worm detection using structural information of executables. Proceedings of the International Workshop on Recent Advances in Intrusion Detection, Seattle, WA, USA.10.1007/11663812_11 ↗
7. Liu, B., Li, W., Huo, W., Li, F., Zou, W., Zhang, C., and Piao, A. (2018, January 3–7). αDiff: Cross-version binary code similarity detection with DNN. Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, Montpellier, France.10.1145/3238147.3238199 ↗
8. Feng, Q., Wang, M., Zhang, M., Zhou, R., Henderson, A., and Yin, H. (2017, January 2–6). Extracting conditional formulas for cross-platform bug search. Proceedings of the 2017 ACM Asia Conference on Computer and Communications Security, Abu Dhabi, United Arab Emirates.10.1145/3052973.3052995 ↗
9. Pewny, J., Garmany, B., Gawlik, R., Rossow, C., and Holz, T. (2015, January 17–21). Cross-architecture bug search in binary executables. Proceedings of the 2015 IEEE Symposium on Security and Privacy, San Jose, CA, USA.10.1109/SP.2015.49 ↗
10. Luo, Z., Wang, P., Wang, B., Tang, Y., Xie, W., Zhou, X., Liu, D., and Lu, K. (March, January 27). VulHawk: Cross-architecture Vulnerability Detection with Entropy-based Binary Code Search. Proceedings of the Network and Distributed Systems Security (NDSS) Symposium, San Diego, CA, USA.
11. Gao, J., Yang, X., Fu, Y., Jiang, Y., and Sun, J. (2018, January 3–7). Vulseeker: A semantic learning based vulnerability seeker for cross-platform binary. Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, Montpellier, France.10.1145/3238147.3240480 ↗
12. David, Y., and Yahav, E. (2014, January 13–17). Tracelet-based code search in executables. Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), San Diego, CA, USA.10.1145/2594291.2594343 ↗
13. Wang, H., Qu, W., Katz, G., Zhu, W., Gao, Z., Qiu, H., Zhuge, J., and Zhang, C. (2022). jTrans: Jump-Aware Transformer for Binary Code Similarity. arXiv.10.1145/3533767.3534367 ↗
14. EnBinDiff: Identifying Data-only Patches for Binaries10.1109/TDSC.2021.3133500 ↗
15. Ding, S.H., Fung, B.C., and Charland, P. (2019, January 19–23). Asm2Vec: Boosting static representation robustness for binary clone search against code obfuscation and compiler optimization. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA.10.1109/SP.2019.00003 ↗
16. David, Y., Partush, N., and Yahav, E. (2016, January 13–17). Statistical similarity of binaries. Proceedings of the 37th ACM SIGPLAN Conference on Programming Language Design and Implementation, Santa Barbara, CA, USA.10.1145/2908080.2908126 ↗
17. Yang, S., Cheng, L., Zeng, Y., Lang, Z., Zhu, H., and Shi, Z. (2021, January 21–24). Asteria: Deep Learning-based AST-Encoding for Cross-platform Binary Code Similarity Detection. Proceedings of the 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), Taipei, Taiwan.10.1109/DSN48987.2021.00036 ↗
18. Chandramohan, M., Xue, Y., Xu, Z., Liu, Y., Cho, C.Y., and Kuan, T.H.B. (2016, January 13–18). BinGo: Cross-Architecture cross-os binary search. Proceedings of the ACM SIGSOFT Symposium on the Foundations of Software Engineering, Seattle, WA, USA.10.1145/2950290.2950350 ↗
19. David, Y., Partush, N., and Yahav, E. (2017, January 18–23). Similarity of binaries through re-optimization. Proceedings of the 38th ACM SIGPLAN Conference on Programming Language Design and Implementation, Barcelona, Spain.10.1145/3062341.3062387 ↗
20. Zynamics (2023, May 24). BinDiff. Available online: https://www.zynamics.com/bindiff.html.
21. Gao, D., Reiter, M.K., and Song, D. (2008, January 20–22). Binhunt: Automatically finding semantic differences in binary programs. Proceedings of the International Conference on Information and Communications Security, Birmingham, UK.10.1007/978-3-540-88625-9_16 ↗
22. Pewny, J., Schuster, F., Bernhard, L., Holz, T., and Rossow, C. (2014, January 8–12). Leveraging semantic signatures for bug search in binary programs. Proceedings of the 30th Annual Computer Security Applications Conference, New Orleans, LA, USA.10.1145/2664243.2664269 ↗
23. Li, X., Yu, Q., and Yin, H. (2021, January 15–19). PalmTree: Learning an Assembly Language Model for Instruction Embedding. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual.10.1145/3460120.3484587 ↗
24. Pei, K., Xuan, Z., Yang, J., Jana, S., and Ray, B. (2020). Trex: Learning execution semantics from micro-traces for binary similarity. arXiv.
25. Massarelli, L., Di Luna, G.A., Petroni, F., Baldoni, R., and Querzoni, L. (2019, January 19–20). Safe: Self-attentive function embeddings for binary similarity. Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Gothenburg, Sweden.10.1007/978-3-030-22038-9_15 ↗
26. Feng, Q., Zhou, R., Xu, C., Cheng, Y., Testa, B., and Yin, H. (2016, January 24–28). Scalable Graph-based Bug Search for Firmware Images. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security—CCS’16, Vienna, Austria.10.1145/2976749.2978370 ↗
27. Xu, X., Liu, C., Feng, Q., Yin, H., Song, L., and Song, D. (November, January 30). Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security—CCS’17, Dallas, TX, USA.10.1145/3133956.3134018 ↗
28. Schroff, F., Kalenichenko, D., and Philbin, J. (2015, January 7–12). Facenet: A unified embedding for face recognition and clustering. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Boston, MA, USA.10.1109/CVPR.2015.7298682 ↗
29. Marcelli, A., Graziano, M., Ugarte-Pedrero, X., Fratantonio, Y., Mansouri, M., and Balzarotti, D. (2022, January 10–12). How Machine Learning is Solving the Binary Function Similarity Problem. Proceedings of the Usenix Security 2022, Boston, MA, USA.
30. Wu, Z., Xiong, Y., Yu, S.X., and Lin, D. (2018, January 18–23). Unsupervised feature learning via non-parametric instance discrimination. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.10.1109/CVPR.2018.00393 ↗
31. Chen, T., Kornblith, S., Norouzi, M., and Hinton, G. (2020, January 13–18). A simple framework for contrastive learning of visual representations. Proceedings of the International Conference on Machine Learning (PMLR), Virtual.
32. Farhadi, M.R., Fung, B.C., Charland, P., and Debbabi, M. (July, January 30). Binclone: Detecting code clones in malware. Proceedings of the 2014 Eighth International Conference on Software Security and Reliability (SERE), San Francisco, CA, USA.10.1109/SERE.2014.21 ↗
33. Ding, S.H., Fung, B.C., and Charland, P. (2016, January 13–17). Kam1n0: MapReduce-based Assembly Clone Search for Reverse Engineering. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining—KDD’16, San Francisco, CA, USA.10.1145/2939672.2939719 ↗
34. Kim, G., Hong, S., Franz, M., and Song, D. (2022, January 18–22). Improving cross-platform binary analysis using representation learning via graph alignment. Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual.10.1145/3533767.3534383 ↗
35. Asteria-Pro: Enhancing Deep-Learning Based Binary Code Similarity Detection by Incorporating Domain Knowledge
36. Qasem, A., Debbabi, M., Lebel, B., and Kassouf, M. (2023, January 10–14). Binary Function Clone Search in the Presence of Code Obfuscation and Optimization over Multi-CPU Architectures. Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security, Melbourne, Australia.10.1145/3579856.3582818 ↗
37. Ahn, S., Ahn, S., Koo, H., and Paek, Y. (2022, January 4–8). Practical binary code similarity detection with bert-based transferable similarity learning. Proceedings of the 38th Annual Computer Security Applications Conference, Austin, TX, USA.10.1145/3564625.3567975 ↗
38. Myles, G., and Collberg, C. (2005, January 13–17). K-gram based software birthmarks. Proceedings of the 2005 ACM Symposium on Applied Computing, Santa Fe, NM, USA.10.1145/1066677.1066753 ↗
39. Jang, J., Woo, M., and Brumley, D. (2013, January 14–16). Towards automatic software lineage inference. Proceedings of the 22nd USENIX Security Symposium (USENIX Security 13), Washington, DC, USA.
40. Eschweiler, S., Yakdan, K., and Gerhards-Padilla, E. (2016, January 21–24). discovRE: Efficient Cross-Architecture Identification of Bugs in Binary Code. Proceedings of the 2016 Network and Distributed System Security Symposium, Internet Society, Reston, VA, USA.10.14722/ndss.2016.23185 ↗
41. Duan, Y., Li, X., Wang, J., and Yin, H. (2020, January 23–26). DeepBinDiff: Learning Program-Wide Code Representations for Binary Diffing. Proceedings of the 27rd Symposium on Network and Distributed System Security (NDSS), San Diego, CA, USA.10.14722/ndss.2020.24311 ↗
42. Yu, Z., Cao, R., Tang, Q., Nie, S., Huang, J., and Wu, S. (2020, January 7–12). Order Matters: Semantic-Aware Neural Networks for Binary Code Similarity Detection. Proceedings of the AAAI Conference on Artificial Intelligence, New York, NY, USA.10.1609/aaai.v34i01.5466 ↗
43. Le, Q., and Mikolov, T. (2014, January 22–24). Distributed representations of sentences and documents. Proceedings of the International Conference on Machine Learning. PMLR, Beijing, China.
44. Devlin, J., Chang, M.W., Lee, K., and Toutanova, K. (2019, January 2–7). BERT: Pre-training of deep bidirectional transformers for language understanding. Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologiese, Minneapolis, MN, USA.
45. He, P., Liu, X., Gao, J., and Chen, W. (2020). Deberta: Decoding-enhanced bert with disentangled attention. arXiv.
46. Rays, H. (2021, December 21). IDA Pro. Available online: https://www.hex-rays.com/products/ida/.
47. Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O., Lewis, M., Zettlemoyer, L., and Stoyanov, V. (2019). RoBERTa: A Robustly Optimized BERT Pretraining Approach. arXiv.
48. Committee, D.S. (2021, December 21). The DWARF Debugging Standard. Available online: https://dwarfstd.org/.
49. Wallach, H., Larochelle, H., Beygelzimer, A., d’Alché-Buc, F., Fox, E., and Garnett, R. (2019, January 8–14). PyTorch: An Imperative Style, High-Performance Deep Learning Library. Proceedings of the Advances in Neural Information Processing Systems, Vancouver, BC, Canada.
50. Wolf, T., Debut, L., Sanh, V., Chaumond, J., Delangue, C., Moi, A., Cistac, P., Rault, T., Louf, R., and Funtowicz, M. (2020, January 16–18). Transformers: State-of-the-Art Natural Language Processing. Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations. Association for Computational Linguistics, Virtual.10.18653/v1/2020.emnlp-demos.6 ↗
51. Mikolov, T., Sutskever, I., Chen, K., Corrado, G., and Dean, J. (2013). Distributed Representations of Words and Phrases and their Compositionality. arXiv.
52. Embedthis (2023, May 20). GoAHead. Available online: https://www.embedthis.com/goahead/.
53. GNU (2023, May 19). Coreutils—GNU Core Utilities. Available online: https://www.gnu.org/software/coreutils/coreutils.html.
54. OpenSSL (2023, May 19). OpenSSL. Available online: https://www.openssl.org/.
55. GNU (2023, May 19). Diffutils—GNU Core Utilities. Available online: https://www.gnu.org/software/diffutils/diffutils.html.
56. Organization, L.K. (2023, May 22). The Linux Kernel Archives. Available online: https://www.kernel.org/.
57. Consortium, S. (2023, May 21). SQLite. Available online: https://www.sqlite.org/index.html.
58. Xu, X., Feng, S., Ye, Y., Shen, G., Su, Z., Cheng, S., Tao, G., Shi, Q., Zhang, Z., and Zhang, X. (2023, January 17–21). Improving Binary Code Similarity Transformer Models by Semantics-Driven Instruction Deemphasis. Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, Seattle, WA, USA.10.1145/3597926.3598121 ↗