GMN+: A Binary Homologous Vulnerability Detection Method Based on Graph Matching Neural Network with Enhanced Attention
Source abstract
Abstract
The widespread reuse of code in the open-source community has led to the proliferation of homologous vulnerabilities, which are security flaws propagated across diverse software systems through the reuse of vulnerable code. Such vulnerabilities pose serious cybersecurity risks, as attackers can exploit the same weaknesses across multiple platforms. Deep learning has emerged as a promising approach for detecting homologous vulnerabilities in binary code due to their automated feature extraction and high efficiency. However, existing deep learning methods often struggle to capture deep semantic features in binary code, limiting their effectiveness. To address this limitation, this paper presents GMN+, which is a novel graph matching neural network with enhanced attention for detecting homologous vulnerabilities. This method comprehensively considers the information contained in instructions and incorporates types of input instruction. Masked Language Modeling and Instruction Type Prediction are developed as pre-training tasks to enhance the ability of GMN+ in extracting semantic information from basic blocks. GMN+ utilizes an attention mechanism to focus concurrently on the critical semantic information within functions and differences between them, generating robust function embeddings. Experimental results indicate that GMN+ outperforms state-of-the-art methods in various tasks and achieves notable performance in real-world vulnerability detection scenarios.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Software System Performance and Reliability · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Artificial Intelligence, Dalian Maritime University, Dalian 116026, China
College of Information of Science and Technology, Dalian Maritime University, Dalian 116026, China
School of Software Technology, Dalian University of Technology, Dalian 116024, China
College of Light Industry, Liaoning University, Shenyang 110036, China
National Administration of State Secrets Protection, Beijing 100044, China
Faculty of Information, Liaoning University, Shenyang 110036, China
Funding
Fundamental Research Funds for the Central Universities · National Natural Science Foundation of China · General Project of Science and Technology Foundation of Liaoning Province of China
References (43)
Show source-provided references
1. Yang, S., Cheng, L., Zeng, Y., Lang, Z., Zhu, H., and Shi, Z. (2021, January 21–24). Asteria: Deep learning-based AST-encoding for cross-platform binary code similarity detection. Proceedings of the 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), Taipei, Taiwan.10.1109/DSN48987.2021.00036 ↗
2. Luo, Z., Wang, P., Wang, B., Tang, Y., Xie, W., Zhou, X., Liu, D., and Lu, K. (March, January 27). VulHawk: Cross-architecture Vulnerability Detection with Entropy-based Binary Code Search. Proceedings of the NDSS, San Diego, CA, USA.
3. (2024, November 16). Synopsys. Available online: https://www.synopsys.com/software-integrity/resources/analyst-reports/open-source-security-risk-analysis.html.
4. HGE-BVHD: Heterogeneous Graph Embedding Scheme of Complex Structure Functions for Binary Vulnerability Homology Discrimination10.1016/j.eswa.2023.121835 ↗
5. A survey on deep learning and its applications10.1016/j.cosrev.2021.100379 ↗
6. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł., and Polosukhin, I. (2017, January 4–9). Attention is all you need. Proceedings of the International Conference on Neural Information Processing Systems, Long Beach, CA, USA.
7. Massarelli, L., Di Luna, G.A., Petroni, F., Baldoni, R., and Querzoni, L. (2019). Safe: Self-attentive function embeddings for binary similarity. Detection of Intrusions and Malware, and Vulnerability Assessment: 16th International Conference, DIMVA 2019, Gothenburg, Sweden, 19–20 June 2019, Proceedings 16, Springer International Publishing.
8. HAN-BSVD: A hierarchical attention network for binary software vulnerability detection10.1016/j.cose.2021.102286 ↗
9. Li, Y., Gu, C., Dullien, T., Vinyals, O., and Kohli, P. (2019, January 10–15). Graph matching networks for learning the similarity of graph structured objects. Proceedings of the International Conference on Machine Learning, Long Beach, CA, USA.
10. FIT: Inspect vulnerabilities in cross-architecture firmware by deep learning and bipartite matching10.1016/j.cose.2020.102032 ↗
11. He, H., Lin, X., Weng, Z., Zhao, R., Gan, S., Chen, L., Ji, Y., Wang, J., and Xue, Z. (2024, January 11–13). Code is not Natural Language: Unlock the Power of Semantics-Oriented Graph Representation for Binary Code Similarity Detection. Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24), Philadelphia, PA, USA.
12. Devlin, J., Chang, M.W., Lee, K., and Toutanova, K. (2018). Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv.
13. Ding, S.H., Fung, B.C., and Charland, P. (2019, January 19–23). Asm2vec: Boosting static representation robustness for binary clone search against code obfuscation and compiler optimization. Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP.2019.00003 ↗
14. Le, Q., and Mikolov, T. (2014, January 22–24). Distributed representations of sentences and documents. Proceedings of the International Conference on Machine Learning, Beijing, China.
15. Mikolov, T., Sutskever, I., Chen, K., Corrado, G.S., and Dean, J. (2013, January 5–8). Distributed representations of words and phrases and their compositionality. Proceedings of the Advances in Neural Information Processing Systems, Lake Tahoe, NV, USA.
16. Chen, X., and Cardie, C. (2018). Unsupervised multilingual word embeddings. arXiv.10.18653/v1/D18-1024 ↗
17. IFAttn: Binary code similarity analysis based on interpretable features with attention10.1016/j.cose.2022.102804 ↗
18. Yu, Z., Cao, R., Tang, Q., Nie, S., Huang, J., and Wu, S. (2020, January 7–12). Order matters: Semantic-aware neural networks for binary code similarity detection. Proceedings of the AAAI Conference on Artificial Intelligence, New York, NY, USA.10.1609/aaai.v34i01.5466 ↗
19. Gilmer, J., Schoenholz, S.S., Riley, P.F., Vinyals, O., and Dahl, G.E. (2017, January 6–11). Neural message passing for quantum chemistry. Proceedings of the International Conference on Machine Learning, Sydney, NSW, Australia.
20. Borrello, P., Easdon, C., Schwarzl, M., Czerny, R., and Schwarz, M. (2023, January 22–24). CustomProcessingUnit: Reverse Engineering and Customization of Intel Microcode. Proceedings of the 2023 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA.10.1109/SPW59333.2023.00031 ↗
21. Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O., Lewis, M., Zettlemoyer, L., and Stoyanov, V. (2019). Roberta: A robustly optimized bert pretraining approach. arXiv.
22. Graph convolutional networks: A comprehensive review10.1186/s40649-019-0069-y ↗
23. BinAIV: Semantic-enhanced vulnerability detection for Linux x86 binaries10.1016/j.cose.2023.103508 ↗
24. Su, J. (2024, November 16). SimBERT: Integrating retrieval and generation into BERT. Tech. Rep. 2023. Available online: https://github.com/ZhuiyiTechnology/simbert.
25. SENSE: An unsupervised semantic learning model for cross-platform vulnerability search10.1016/j.cose.2023.103500 ↗
26. Geng, M., Wang, S., Dong, D., Wang, H., Li, G., Jin, Z., Mao, X., and Liao, X. (2024, January 14–20). Large Language Models are Few-Shot Summarizers: Multi-Intent Comment Generation via In-Context Learning. Proceedings of the IEEE/ACM 46th International Conference on Software Engineering, ICSE ’24, New York, NY, USA.10.1145/3597503.3608134 ↗
27. GRACE: Empowering LLM-based software vulnerability detection with graph structure and in-context learning10.1016/j.jss.2024.112031 ↗
28. Dong, Q., Li, L., Dai, D., Zheng, C., Ma, J., Li, R., Xia, H., Xu, J., Wu, Z., and Liu, T. (2024). A Survey on In-context Learning. arXiv.10.18653/v1/2024.emnlp-main.64 ↗
29. Xu, X., Liu, C., Feng, Q., Yin, H., Song, L., and Song, D. (November, January 30). Neural network-based graph embedding for cross-platform binary code similarity detection. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.10.1145/3133956.3134018 ↗
30. Song, L. (2018). Structure2vec: Deep Learning for Security Analytics over Graphs, USENIX.
31. Zhang, Y., Liu, Y., Cheng, G., and Ou, B. (March, January 26). GTrans: Graph Transformer-Based Obfuscation-resilient Binary Code Similarity Detection. Proceedings of the NDSS Symposium 2024, San Diego, CA, USA.
32. Tai, K.S., Socher, R., and Manning, C.D. (2015). Improved Semantic Representations From Tree-Structured Long Short-Term Memory Networks. arXiv.10.3115/v1/P15-1150 ↗
33. Gao, J., Yang, X., Fu, Y., Jiang, Y., and Sun, J. (2018, January 3–7). Vulseeker: A semantic learning based vulnerability seeker for cross-platform binary. Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, Montpellier, France.10.1145/3238147.3240480 ↗
34. LSTM: A Search Space Odyssey10.1109/TNNLS.2016.2582924 ↗
35. Yu, S.Y., Achamyeleh, Y.G., Wang, C., Kocheturov, A., Eisen, P., and Al Faruque, M.A. (2023, January 17–19). Cfg2vec: Hierarchical graph neural network for cross-architectural software reverse engineering. Proceedings of the 2023 IEEE/ACM 45th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), Melbourne, Australia.10.1109/ICSE-SEIP58684.2023.00031 ↗
36. Wang, J., Zhang, C., Chen, L., Rong, Y., Wu, Y., Wang, H., Tan, W., Li, Q., and Li, Z. (2024, January 11–13). Improving ML-based Binary Function Similarity Detection by Assessing and Deprioritizing Control Flow Graph Features. Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24), Philadelphia, PA, USA.
37. Liu, X., Wu, Y., Yu, Q., Song, S., Liu, Y., Zhou, Q., and Zhuge, J. (2022, January 19–23). PG-VulNet: Detect Supply Chain Vulnerabilities in IoT Devices using Pseudo-code and Graphs. Proceedings of the 16th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement, Helsinki, Finland.10.1145/3544902.3546240 ↗
38. VDTriplet: Vulnerability detection with graph semantics using triplet model10.1016/j.cose.2024.103732 ↗
39. Guo, D., Lu, S., Duan, N., Wang, Y., Zhou, M., and Yin, J. (2022). Unixcoder: Unified cross-modal pre-training for code representation. arXiv.10.18653/v1/2022.acl-long.499 ↗
40. Sun, F.Y., Hoffmann, J., Verma, V., and Tang, J. (2019). Infograph: Unsupervised and semi-supervised graph-level representation learning via mutual information maximization. arXiv.
41. (2024, March 08). IDA Pro. Available online: https://www.hex-rays.com/products/ida/.
42. Li, Y., Tarlow, D., Brockschmidt, M., and Zemel, R. (2015). Gated graph sequence neural networks. arXiv.
43. Wang, Y., Wang, L., Li, Y., He, D., and Liu, T.Y. (2013, January 12–14). A theoretical analysis of NDCG type ranking measures. Proceedings of the Conference on Learning Theory, Princeton, NJ, USA.