B2SMatcher: fine-Grained version identification of open-Source software in binary files

Abstract

Codes of Open Source Software (OSS) are widely reused during software development nowadays. However, reusing some specific versions of OSS introduces 1-day vulnerabilities of which details are publicly available, which may be exploited and lead to serious security issues. Existing state-of-the-art OSS reuse detection work can not identify the specific versions of reused OSS well. The features they selected are not distinguishable enough for version detection and the matching scores are only based on similarity.This paper presents B2SMatcher, a fine-grained version identification tool for OSS in commercial off-the-shelf (COTS) software. We first discuss five kinds of version-sensitive code features that are trackable in both binary and source code. We categorize these features into program-level features and function-level features and propose a two-stage version identification approach based on the two levels of code features. B2SMatcher also identifies different types of OSS version reuse based on matching scores and matched feature instances. In order to extract source code features as accurately as possible, B2SMatcher innovatively uses machine learning methods to obtain the source files involved in the compilation and uses function abstraction and normalization methods to eliminate the comparison costs on redundant functions across versions. We have evaluated B2SMatcher using 6351 candidate OSS versions and 585 binaries. The result shows that B2SMatcher achieves a high precision up to 89.2% and outperforms state-of-the-art tools. Finally, we show how B2SMatcher can be used to evaluate real-world software and find some security risks in practice.

Cross-Inlining Binary Function Similarity Detection

“…To help resolve these code-reuse-related issues, many binary code similarity analysis works are proposed and have been applied in various applications, including code search [29,30,37,63,79,81], OSS reuse detection [19,31,35,36,43,53,68,71,77], vulnerability detection [25,26,38,76] and patch presence test [51,61,74,78,82]. They usually regard the vulnerable functions or reused functions as the query functions and the functions in the commercial software as the target functions and produce the detection results by calculating the similarity between query functions and target functions.…”