jTrans: Jump-Aware Transformer for Binary Code Similarity

Abstract

Binary code similarity detection (BCSD) has important applications in various fields such as vulnerabilities detection, software component analysis, and reverse engineering. Recent studies have shown that deep neural networks (DNNs) can comprehend instructions or control-flow graphs (CFG) of binary code and support BCSD. In this study, we propose a novel Transformer-based approach, namely jTrans, to learn representations of binary code. It is the first solution that embeds control flow information of binary code into Transformer-based language models, by using a novel jump-aware representation of the analyzed binaries and a newly-designed pre-training task. Additionally, we release to the community a newly-created large dataset of binaries, BinaryCorp, which is the most diverse to date. Evaluation results show that jTrans outperforms state-of-the-art (SOTA) approaches on this more challenging dataset by 30.5% (i.e., from 32.0% to 62.5%). In a real-world task of known vulnerability searching, jTrans achieves a recall that is 2X higher than existing SOTA baselines. CCS CONCEPTS• Security and privacy → Software reverse engineering; • Computing methodologies → Machine learning.

PS3: Precise Patch Presence Test based on Semantic Symbolic Signature

“…We use IDA Pro binary, a disassembler tool [31] to dump the binary code of the functions for BinXray, which is the same as the BinXray used in their original experiments. To the best of our knowledge, no official open source implementation of Asm2Vec is available, so we utilized an unofficial implementation 5 followed [34] with default parameter settings. The experimental setup consists of an Intel CPU operating at 2.90GHz and running on Linux.…”

IoTSim: Internet of Things-Oriented Binary Code Similarity Detection with Multiple Block Relations

“…Moreover, traditional graph-based methods such as graph isomorphism matching are excessively time-consuming for analyzing large-scale firmware, leading to relatively lower accuracy and scalability. In recent years, researchers have increasingly adopted learning-based approaches to tackle BCSD tasks, and the current state-of-the-art BCSD approaches [11,13,14,34,35] are predominantly based on machine learning (ML) techniques. These approaches typically involve the disassembly of binary code into either assembly language or intermediate representation (IR).…”

“…As a consequence, considerable differences arise at the lexical and syntactic levels, resulting in severe OOV challenges. For OOV words, existing approaches [11,34,35,37] use normalization based on predefined rules to deal with string literals, immediate numbers, and address offsets. However, when these special words are replaced with dummy tokens, the essential semantics may be compromised.…”

“…Binary code similarity detection is a fundamental technique in computer security that can detect similarities between two binary code snippets. It is widely used for various applications, including vulnerability detection [ 8 , 9 , 10 , 11 , 12 , 13 , 14 , 15 , 16 , 17 , 18 , 19 , 20 , 21 , 22 ], malware analysis [ 23 , 24 , 25 , 26 , 27 , 28 ], and binary patch analysis [ 29 , 30 , 31 ]. Figure 1 shows an example of BCSD usage in firmware security analysis.…”

“…In recent years, researchers have increasingly adopted learning-based approaches to tackle BCSD tasks, and the current state-of-the-art BCSD approaches [ 11 , 13 , 14 , 34 , 35 ] are predominantly based on machine learning (ML) techniques. These approaches typically involve the disassembly of binary code into either assembly language or intermediate representation (IR).…”