A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

Abstract

Given a closed-source program, such as most of proprietary software and viruses, binary code analysis is indispensable for many tasks, such as code plagiarism detection and malware analysis. Today, source code is very often compiled for various architectures, making cross-architecture binary code analysis increasingly important. A binary, after being disassembled, is expressed in an assembly languages. Thus, recent work starts exploring Natural Language Processing (NLP) inspired binary code analysis. In NLP, words are usually represented in high-dimensional vectors (i.e., embeddings) to facilitate further processing, which is one of the most common and critical steps in many NLP tasks. We regard instructions as words in NLPinspired binary code analysis, and aim to represent instructions as embeddings as well.To facilitate cross-architecture binary code analysis, our goal is that similar instructions, regardless of their architectures, have embeddings close to each other. To this end, we propose a joint learning approach to generating instruction embeddings that capture not only the semantics of instructions within an architecture, but also their semantic relationships across architectures. To the best of our knowledge, this is the first work on building crossarchitecture instruction embedding model. As a showcase, we apply the model to resolving one of the most fundamental problems for binary code similarity comparison-semantics-based basic block comparison, and the solution outperforms the code statistics based approach. It demonstrates that it is promising to apply the model to other cross-architecture binary code analysis tasks.

BinDiffNN : Learning Distributed Representation of Assembly for Robust Binary Diffing Against Semantic Differences

“…1:1 mapping phase that is similar to the function matching research and classification phase using the semantic aware neural network. In the literature, function matching is addressed by using traditional featurebased approaches [1], [7], [3], [8], [2], [5], [4], [9], [10] and also by using the deep learning approaches [11], [12], [13] with an objective to find the similarity between two functions. In contrast, our neural network-based approach aims to find the similarity and differences in two binary functions.…”

“…Zuo et al [12] proposed INNEREYE that uses LSTM to treat instructions as words and basic blocks as sentences and train the neural network to compare two basic block embeddings for cross-architecture to predict their similarity score. Redmond et al [13] extends the Zuo [12] work using joint learning approach to generate an instruction embedding. Lie et al [29] uses a combination of distance features to find similarities between two functions.…”

“…In step 2, we compute the cosine distance (line 11) of each one-shot vector (in Bin A ) against all the feature matrix (all one-shot feature vectors) of compared binary (Bin A ). The output is a distance matrix (line 12) and its minimum distance index is considered as the match, if the minimum distance is less than or equal to 0.1 (90% similarity) then the functions at these indexes are mapped (lines [13][14][15][16][17][18]. Once the mapping process between Bin A and Bin A ends then the remaining functions are categorized as no-match (lines 23-27).…”

A Neural Network-Based Approach for Cryptographic Function Detection in Malware

“…Zuo et al's work [10] solved the task of binary similarity by converting a basic block into an embedding and measuring the distance between two embeddings, and instructions in a basic block are combined through the use of a Long Short-Term Memory (LSTM). Redmond et al [11] proposed a joint learning approach to generating instruction embeddings that capture not only the semantics of instructions within architecture but also their semantic relationships across architectures. SAFE [12], proposed by Massarelli et al, is a general architecture for calculating binary function embeddings starting from disassembled binaries, using a self-attentive recurrent neural network that parses all instructions according to their addresses.…”

BEDetector: A Two-Channel Encoding Method to Detect Vulnerabilities Based on Binary Similarity

“…Inspired by NLP(natural language processing), Baldoni et al [21] embed the instructions with word2vec model and optimize the hyperparameters using siamese structure. Redmond et al [22] explore binary instruction embedding across architectures. They convert the binary code to intermediate language and recorded the input/output as signature for comparison.…”