Binary Similarity Detection Using Machine Learning

Shalev, Noam; Partush, Nimrod

doi:10.1145/3264820.3264821

Cited by 26 publications

(13 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In order to better perform the embedding learning of word vectors, literature [15] introduces a new vector representation method proc2vec. First, split the program assembly code into basic blocks and use the strands that compose a code section as feature set, transforming strands to numbers and assembling those numbers to form a vector that represents the corresponding code.…”

Section: Semantic-based Clone Detection Methodsmentioning

confidence: 99%

A Survey of Automatic Software Vulnerability Detection, Program Repair, and Defect Prediction Techniques

Shen

Chen

2020

Security and Communication Networks

View full text Add to dashboard Cite

Open source software has been widely used in various industries due to its openness and flexibility, but it also brings potential software security problems. Together with the large-scale increase in the number of software and the increase in complexity, the traditional manual methods to deal with these security issues are inefficient and cannot meet the current cyberspace security requirements. Therefore, it is an important research topic for researchers in the field of software security to develop more intelligent technologies to apply to potential security issues in software. The development of deep learning technology has brought new opportunities for the study of potential security issues in software, and researchers have successively proposed many automation methods. In this paper, these automation technologies are evaluated and analysed in detail from three aspects: software vulnerability detection, software program repair, and software defect prediction. At the same time, we point out some problems of these research methods, give corresponding solutions, and finally look forward to the application prospect of deep learning technology in automated software vulnerability detection, automated program repair, and automated defect prediction.

show abstract

Section: Semantic-based Clone Detection Methodsmentioning

confidence: 99%

A Survey of Automatic Software Vulnerability Detection, Program Repair, and Defect Prediction Techniques

Shen

Chen

2020

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Li et al [28] extracted tokens from known methodlevel code clones and non-clones to train a 6-layerd perceptron, and then used the classifier to detect syntactic clones. Shalev and Partush [29] detected similarities between code blocks by breaking them up into smaller regions of a few lines of assembly code; normalizing these code regions; obtaining small sized MD5 hashes of the regions; creating a fixed size hash for a code block; and then training a 4-layered perceptron to detect if two code blocks are clones. Wei and Ming [30] developed an end-to-end approach to detect Type IV clones, using Long Short Term Memory (LSTMs), a special type of RNNs.…”

Section: B Machine Learning In Clone Detectionmentioning

confidence: 99%

An Effective Semantic Code Clone Detection Framework Using Pairwise Feature Fusion

2021

View full text Add to dashboard Cite

Code clone detection is important for effective software maintenance. The task is more challenging when clones are semantically similar (Type-IV) in nature, having no structural resemblance to each other. Most existing methods use sequence similarity and/or graph isomorphism between either Abstract Syntax Trees (AST) or Program Dependency Graphs (PDG) to detect Type-I, II and III clones. However, they are mostly unsuccessful in detecting semantic or Type-IV clones. In this work, we propose a novel detection framework using machine learning for automated detection of all four type of clones. The features extracted from a pair code blocks are combined for possible detection of a clone with respect to reference block. We use ASTs and PDGs features of both the code blocks to prepare labelled training samples after fusing the two feature vectors using three different alternatives. We use six (06) state-of-the-art classification models including Deep Convolutional Neural Network to assess the prediction performance of our scheme. To access the effectiveness of our framework we use seven (07) datasets and compare its performance with five state-of-the-art clone detectors. We also compare a large number of algorithms for code clone detection. Comparing the performance of a large number of machine learning techniques, ANN and non-ANN, using such features, and establishing that fusing of AST and PDG features gives competitive results using deep learning as well as boosted tree algorithms, and find that boosted tree algorithms like XGBOOT are quite competitive in clone detection. Experimental results demonstrate that our approach outperforms existing clone detection methods in terms of prediction accuracy.

show abstract

“…Learning-Based Analysis. In recent years, there has been significant research on applying learning-based techniques such as machine learning [30,37,42], deep neural networks [33,48], and natural language processing [50] for similarity detection. Although learning-based methods are efficient and show promising results, they require extraneous training of an available dataset.…”

Section: Static and Dynamic Analysismentioning

confidence: 99%

“…The state-of-the-art provides various techniques to compare two binaries [7,12,33,35,39,42,50]. A broad class of the comparison techniques is statistical or learning-based [13,48,50].…”

Section: Introductionmentioning

confidence: 99%

Verification of Functional Correctness of Code Diversification Techniques

Jang

Verbeek

Ravindran

2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Code diversification techniques are popular code-reuse attacks defense. The majority of code diversification research focuses on analyzing non-functional properties, such as whether the technique improves security. This paper provides a methodology to verify functional equivalence between the original and a diversified binary. We present a formal notion of binary equivalence resilient to diversification. Moreover, an algorithm is presented that checks whether two binaries -one original and one diversified -satisfy that notion of equivalence. The purpose of our work is to allow untrusted diversification techniques in a safety-critical context. We apply the methodology to three state-ofthe-art diversification techniques used on the GNU Coreutils package. Overall, results show that our method can prove functional equivalence for 85,315 functions in the analyzed binaries.

show abstract

Binary Similarity Detection Using Machine Learning

Cited by 26 publications

References 8 publications

A Survey of Automatic Software Vulnerability Detection, Program Repair, and Defect Prediction Techniques

A Survey of Automatic Software Vulnerability Detection, Program Repair, and Defect Prediction Techniques

An Effective Semantic Code Clone Detection Framework Using Pairwise Feature Fusion

Verification of Functional Correctness of Code Diversification Techniques

Contact Info

Product

Resources

About