Codee: A Tensor Embedding Scheme for Binary Code Search

Abstract

Given a target binary function, the binary code search retrieves top-K similar functions in the repository, and similar functions represent that they are compiled from the same source codes. Searching binary code is particularly challenging due to large variations of compiler tool-chains and options and CPU architectures, as well as thousands of binary codes. Furthermore, there are some pivotal issues in current binary code search schemes, including inaccurate text-based or token-based analysis, slow graph matching, or complex deep learning processes. In this paper, we present an unsupervised tensor embedding scheme, Codee, to carry out code search efficiently and accurately at the binary function level. First, we use an NLP-based neural network to generate the semantic-aware token embedding. Second, we propose an efficient basic block embedding generation algorithm based on the network representation learning model. We learn both the semantic information of instructions and the control flow structural information to generate the basic block embedding. Then we use all basic block embeddings in a function to obtain a variable-length function feature vector. Third, we build a tensor to generate function embeddings based on the tensor singular value decomposition, which compresses the variable-length vectors into short fixed-length vectors to facilitate efficient search afterward. We further propose a dynamic tensor compression algorithm to incrementally update the function embedding database. Finally, we use the local sensitive hash method to find the top-K similar matching functions in the repository. Compared with state-of-the-art cross-optimization-level code search schemes, such as Asm2Vec and DeepBinDiff, our scheme achieves higher average search accuracy, shorter feature vectors, and faster feature generation performance using four datasets, OpenSSL, Coreutils, libgmp and libcurl. Compared with other cross-platform and cross-optimization-level code search schemes, such as Gemini, Safe, the average recall of our method also outperforms others.

Hierarchical Attention Graph Embedding Networks for Binary Code Similarity against Compilation Diversity

“…Nevertheless, it does not use the normalization method for assembly instruction. DEEPBINDIFF [22] and Codee [45] also consider the division of instructions into opcodes and operands, and they adopt a normalization strategy for dealing with operands. BinDeep [46] applies a more fine-grained normalization strategy.…”

jTrans: Jump-Aware Transformer for Binary Code Similarity

“…The study of learning-based BCSD has been inspired by recent development in natural language processing (NLP) [39,45,56], which uses real-valued vectors called embeddings to encode semantic information of words and sentences. Building upon these techniques, previous studies [14,15,24,40,43,44,51,59,[61][62][63] applied deep learning methods to binary similarity detection. Shared by many of these studies is the idea of embedding binary functions into numerical vectors, and then using vector distance to approximate the similarity between different binary functions.…”

“…Gemini and VulSeeker encode basic blocks with manually-selected features, while GraphEmb and OrderMatters use neural networks to learn the embeddings of basic blocks. Another approach is propsoed by DEEPBINDIFF [15] and Codee [61], which uses neural networks to learn the embeddings of generated instruction sequences instead of embedding the ACFG of binary functions.…”

“…Some approaches [24,59] ignore the semantics of instructions and basic blocks, as they only use manually-selected features to represent basic blocks. Other approaches [14,15,40,43,51,61,63] neglect some or all of the structural information of binary functions, as they do not use the control-flow information, or generate instruction sequences with CFG using random walk. Finally, methods such as [44,62] learn basic block embeddings, and use GNN to learn the embedding of attributed control-flow graph (ACFG) of binary functions.…”

Simplified abstract syntax tree based semantic features learning for software change prediction

“…Therefore, we can leverage semantic features to improve change prediction models. In recent years, researchers have utilized deep learning technology to extract effective features from code to perform defect prediction, [12][13][14] code clone detection, 15,16 code search, 17,18 code summary, 19,20 and other software engineering tasks. Their common practice is to employ an abstract syntax tree (AST) to model the semantic information of the code.…”